GHSA-56j4-446m-qrf6 Babylon vulnerable to chain half when transaction has fees different than `ubbn`
An attacker can halt the Babylon blockchain by submitting transactions with non-native fee denominations, causing a panic in the distribution module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-56j4-446m-qrf6?
GHSA-56j4-446m-qrf6 is a denial of service vulnerability in github.com/babylonlabs-io/babylon, published on 30 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Summary
Sending transactions with fees different than native Babylon genesis denom (ubbn) leads to chain halt.
Impact
Denial of Service - Due to panic in the x/distribution module BeginBlocker triggered by a error when sending fees from feeCollector to x/distribution module - https://github.com/cosmos/cosmos-sdk/blob/main/x/distribution/keeper/allocation.go#L28 Babylon Genesis will halt
Which versions are affected by GHSA-56j4-446m-qrf6?
6 open source packages ship an affected version, including github.com/babylonlabs-io/babylon and github.com/babylonlabs-io/babylon/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/babylonlabs-io/babylon Go | All versions | None |
github.com/babylonlabs-io/babylon Go | All versions to 1.1.0 | None |
github.com/babylonlabs-io/babylon Go | All versions to 1.1.0 | None |
github.com/babylonlabs-io/babylon/v2 Go | All versions | 2.2.0 |
github.com/babylonlabs-io/babylon/v2 Go | All versions | 2.2.0 |
github.com/babylonlabs-io/babylon/v2 Go | All versions | 2.2.0 |
How do I fix GHSA-56j4-446m-qrf6?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-56j4-446m-qrf6 being exploited?
There is no known exploitation of GHSA-56j4-446m-qrf6 in the wild and no public exploit code.
Sources
Also known as GO-2025-3791.