30 matches found
CVE-2026-58262
Klever-Go (Go implementation of the Klever blockchain protocol) contains a vulnerability prior to version 1.7.20 in header signature verification. The verification counts unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any v...
GO-2025-4236 Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration in github.com/babylonlabs-io/finality-provider
Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration in github.com/babylonlabs-io/finality-provider...
EUVD-2025-203111
Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration...
GHSA-4JMP-X7MH-RGMR Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration
Summary The anti-slashing is not effective if the attacker can access EOTS manager endpoints. Impact If the EOTS manager endpoints are open to public without HMAC protection, the attacker can manually cause slashing of the finality provider through the RPC endpoints. Report credits go to:...
Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration
Summary The anti-slashing is not effective if the attacker can access EOTS manager endpoints. Impact If the EOTS manager endpoints are open to public without HMAC protection, the attacker can manually cause slashing of the finality provider through the RPC endpoints. Report credits go to:...
Incomplete Cleanup
Overview Affected versions of this package are vulnerable to Incomplete Cleanup in the x/costaking process. An attacker can continue to accrue rewards without maintaining any actual BTC stake by exploiting a state inconsistency that occurs when a Finality Provider becomes inactive at the same blo...
GHSA-4RMQ-MC2C-R495 Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond
Summary A state consistency bug in x/costaking can leave a BTC delegator with non-zero ActiveSatoshis Phatom Stake even after they have fully unbonded their BTC delegation, if their Finality Provider FP drops out of the active set in the exact same babylon block height. This creates a “phantom...
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond
Summary A state consistency bug in x/costaking can leave a BTC delegator with non-zero ActiveSatoshis Phatom Stake even after they have fully unbonded their BTC delegation, if their Finality Provider FP drops out of the active set in the exact same babylon block height. This creates a “phantom...
EUVD-2025-18921
Malicious code in bioql PyPI...
EUVD-2025-16144
Malicious code in bioql PyPI...
CVE-2025-59941
go-f3 is a Golang implementation of Fast Finality for Filecoin F3. In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass...
CVE-2025-59941
go-f3 is a Golang implementation of Fast Finality for Filecoin F3. In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass...
CVE-2025-59941 go-f3 is Vulnerable to Cached Justification Verification Bypass
go-f3 is a Golang implementation of Fast Finality for Filecoin F3. In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass...
Go implementation of Fast Finality in Filecoin 输入验证错误漏洞
Go implementation of Fast Finality in Filecoin is an open source Golang library for Filecoin with a fast validation mechanism. An input validation error vulnerability exists in Go implementation of Fast Finality in Filecoin 0.8.6 and prior versions, which stems from an integer overflow when...
Go implementation of Fast Finality in Filecoin 安全漏洞
Go implementation of Fast Finality in Filecoin is a Golang library for a fast validation mechanism open-sourced by Filecoin. A security vulnerability exists in Go implementation of Fast Finality in Filecoin version 0.8.8 and earlier, which stems from the validation result caching mechanism not...
PT-2025-39916
Name of the Vulnerable Software and Affected Versions go-f3 versions 0.8.8 and below Description go-f3’s justification verification caching mechanism improperly caches verification results without considering the message context. An attacker can bypass justification verification by submitting a...
CVE-2025-48886
Hydra is a layer-two scalability solution for Cardano. Prior to version 0.22.0, the process assumes L1 event finality and does not consider failed transactions. Currently, Cardano L1 is monitored for certain events which are necessary for state progression. At the moment, Hydra considers those...
CVE-2025-48886 hydra-node dangerously assumes L1 event finality and does not consider failed transactions
Hydra is a layer-two scalability solution for Cardano. Prior to version 0.22.0, the process assumes L1 event finality and does not consider failed transactions. Currently, Cardano L1 is monitored for certain events which are necessary for state progression. At the moment, Hydra considers those...
CVE-2025-48886 hydra-node dangerously assumes L1 event finality and does not consider failed transactions
Hydra is a layer-two scalability solution for Cardano. Prior to version 0.22.0, the process assumes L1 event finality and does not consider failed transactions. Currently, Cardano L1 is monitored for certain events which are necessary for state progression. At the moment, Hydra considers those...
CVE-2025-48886
Hydra, a Layer-2 scaling solution for Cardano, is affected by a vulnerability that arises from assuming L1 finality and neglecting failed transactions. Before version 0.22.0, Hydra treated certain L1 events as finalized as soon as recognized by node participants, making those transactions targets...