Skip to content

Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt

High
KonradStaniec published GHSA-869w-47c6-fq8q May 13, 2025

Package

gomod github.com/babylonlabs-io/babylon (Go)

Affected versions

<1.1.0

Patched versions

1.1.0

Description

Summary

Minting large amount of tokens through ibc transfer and then depositing them in validator rewards pool (via DepositValidatorRewardsPool message) can lead to integer overflow panic when calculating cumulative_reward_ratio for the validator.

This calculation happens in x/epoching module EndBlocker, thus the panic will halt the chain.

Impact

Denial of Service - Due to panic in the EndBlocker Babylon Genesis will halt

Severity

High

CVE ID

No known CVE

Weaknesses

No CWEs