Listen to this Post
How the CVE Works:
The vulnerability exists in Babylon’s `x/costaking` module. When a BTC delegator initiates an unbonding request to withdraw their staked capital, the system schedules the release for a future block. If the delegator’s assigned Finality Provider (FP) coincidentally becomes inactive (e.g., drops from the active set) at the exact same Babylon block height as the unbonding execution, a state accounting error occurs. The module’s `RemoveBTCDelegation` function fails to properly decrement the `ActiveSatoshis` for that FP-delegator pair. This leaves a non-zero “phantom stake” entry in the active stake tracking logic. Consequently, the costaking reward distribution mechanism continues to allocate staking rewards to the delegator’s address based on this ghost stake, even though their actual BTC capital has been fully withdrawn and the FP is no longer validating.
DailyCVE Form:
Platform: Babylon Chain
Version: costaking module
Vulnerability: Phantom stake
Severity: Moderate
Date: 2024-12-08
Prediction: Patch 2024-12-22
What Undercode Say:
Analytics:
babylond query staking delegator-to-validator <delegator_addr> <fp_valoper_addr> babylond query costaking active-satoshi <fp_valoper_addr> babylond query slashing signing-info <fp_valoper_addr>
How Exploit:
1. Delegate BTC to FP.
2. Request full unbond.
3. Coordinate/trigger FP inactivation at unbond height.
4. Withdraw BTC capital.
5. Continue accruing rewards indefinitely.
Protection from this CVE:
1. Upgrade `x/costaking`.
2. Add state transition validation.
3. Implement epoch-boundary checks.
Impact:
Unbacked reward inflation.
Theft of protocol funds.
Erodes system trust.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
