GHSA-4jmp-x7mh-rgmr Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration
Attackers can bypass anti-slashing protections and cause slashing if EOTS manager endpoints are publicly accessible without HMAC protection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-4jmp-x7mh-rgmr?
GHSA-4jmp-x7mh-rgmr is a vulnerability in github.com/babylonlabs-io/finality-provider, published on 12 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
The anti-slashing is not effective if the attacker can access EOTS manager endpoints.
Impact
If the EOTS manager endpoints are open to public without HMAC protection, the attacker can manually cause slashing of the finality provider through the RPC endpoints.
Report credits go to: x.com/RebelsRunways
Which versions are affected by GHSA-4jmp-x7mh-rgmr?
5 open source packages ship an affected version, including github.com/babylonlabs-io/finality-provider.
| Package | Affected | Fixed in |
|---|---|---|
github.com/babylonlabs-io/finality-provider Go | All versions | None |
github.com/babylonlabs-io/finality-provider Go | All versions | None |
github.com/babylonlabs-io/finality-provider Go | All versions | None |
github.com/babylonlabs-io/finality-provider Go | All versions | 1.0.4 |
github.com/babylonlabs-io/finality-provider Go | All versions | 1.0.4 |
How do I fix GHSA-4jmp-x7mh-rgmr?
Upgrade github.com/babylonlabs-io/finality-provider to 1.0.4 or later.
Is GHSA-4jmp-x7mh-rgmr being exploited?
There is no known exploitation of GHSA-4jmp-x7mh-rgmr in the wild and no public exploit code.
Sources
Also known as GO-2025-4236.