{"id":"GHSA-56j4-446m-qrf6","aliases":["GO-2025-3791"],"url":"https://o3.security/vulnerability/GHSA-56j4-446m-qrf6","summary":"Babylon vulnerable to chain half when transaction has fees different than `ubbn`","details":"### Summary\n\nSending transactions with fees different than native Babylon genesis denom (`ubbn`) leads to chain halt.\n\n### Impact\n\nDenial of Service - Due to panic in the `x/distribution` module `BeginBlocker` triggered by a error when sending fees  from `feeCollector` to `x/distribution` module - https://github.com/cosmos/cosmos-sdk/blob/main/x/distribution/keeper/allocation.go#L28 Babylon Genesis will halt","published":"2025-06-30T17:54:02Z","modified":"2025-07-29T23:43:41Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/babylonlabs-io/babylon/v2","fixedVersion":"2.2.0"},{"ecosystem":"Go","name":"github.com/babylonlabs-io/babylon","fixedVersion":null}],"fix":{"url":"https://github.com/babylonlabs-io/babylon/commit/fe67aebd5216e7d3afa1d7dee2a3f82e548556f3","label":"babylonlabs-io/babylon@fe67aeb"},"references":[{"type":"WEB","url":"https://github.com/babylonlabs-io/babylon/security/advisories/GHSA-56j4-446m-qrf6"},{"type":"WEB","url":"https://github.com/babylonlabs-io/babylon/commit/fe67aebd5216e7d3afa1d7dee2a3f82e548556f3"},{"type":"PACKAGE","url":"https://github.com/babylonlabs-io/babylon"},{"type":"WEB","url":"https://github.com/cosmos/cosmos-sdk/blob/main/x/distribution/keeper/allocation.go#L28"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-07-29T23:43:41Z"}}