{"id":"GHSA-869w-47c6-fq8q","aliases":["GO-2025-3687"],"url":"https://o3.security/vulnerability/GHSA-869w-47c6-fq8q","summary":"Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt","details":"### Summary\nMinting large amount of tokens through ibc transfer and then depositing them in validator rewards pool (via `DepositValidatorRewardsPool` message) can lead to integer overflow panic when calculating `cumulative_reward_ratio` for the validator.\n\nThis calculation happens in `x/epoching` module `EndBlocker`, thus the panic will halt the chain.\n\n### Impact\n\nDenial of Service - Due to panic in the `EndBlocker` Babylon Genesis will halt","published":"2025-05-15T14:05:50Z","modified":"2025-05-22T14:57:31Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/babylonlabs-io/babylon","fixedVersion":"1.1.0"}],"fix":{"url":"https://github.com/babylonlabs-io/babylon/commit/f0a29d60f206268b56992fa50f38a48077eb4f59","label":"babylonlabs-io/babylon@f0a29d6"},"references":[{"type":"WEB","url":"https://github.com/babylonlabs-io/babylon/security/advisories/GHSA-869w-47c6-fq8q"},{"type":"WEB","url":"https://github.com/babylonlabs-io/babylon/commit/f0a29d60f206268b56992fa50f38a48077eb4f59"},{"type":"PACKAGE","url":"https://github.com/babylonlabs-io/babylon"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2025-3687"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-05-22T14:57:31Z"}}