GHSA-xq4h-wqm2-668w Babylon's BIP322 signature implementation is not fully compliant to the spec
Attackers can submit non-compliant BIP-322 signatures that are incorrectly accepted by the blockchain, bypassing signature verification requirements.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xq4h-wqm2-668w?
GHSA-xq4h-wqm2-668w is a vulnerability in github.com/babylonlabs-io/babylon, published on 24 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
The BIP-322 signature verification does not enforce the SIGHASH value to be SIGHASH_ALL, and therefore is not strictly following the spec.
Impact
Non-compliant BIP-322 signatures in proof of possessions can be accepted by the chain.
Which versions are affected by GHSA-xq4h-wqm2-668w?
6 open source packages ship an affected version, including github.com/babylonlabs-io/babylon/v4, github.com/babylonlabs-io/babylon and github.com/babylonlabs-io/babylon/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/babylonlabs-io/babylon/v4 Go | All versions | 4.1.0 |
github.com/babylonlabs-io/babylon/v4 Go | All versions | 4.1.0 |
github.com/babylonlabs-io/babylon/v4 Go | All versions | 4.1.0 |
github.com/babylonlabs-io/babylon Go | All versions | None |
github.com/babylonlabs-io/babylon/v2 Go | All versions | None |
github.com/babylonlabs-io/babylon/v3 Go | All versions | None |
How do I fix GHSA-xq4h-wqm2-668w?
Upgrade github.com/babylonlabs-io/babylon/v4 to 4.1.0 or later.
Is GHSA-xq4h-wqm2-668w being exploited?
There is no known exploitation of GHSA-xq4h-wqm2-668w in the wild and no public exploit code.
Sources
Also known as GO-2025-4159.