Babylon Acknowledges Vulnerability in Block Signature Scheme

TL;DR

• Babylon identified a vulnerability in the BLS vote extension scheme that allows validators to omit the block hash and trigger consensus failures.
• The flaw causes errors at epoch boundaries, where the code processes incomplete votes and can lead to validator crashes and slower block production.
• The bug was reported on GitHub and has no known active exploits so far.

Babylon identified a vulnerability in its staking code that could affect the consensus process and slow block production at specific points in the network’s cycle. The issue was found in the block signature scheme known as the BLS vote extension, a component used to prove that validators have reached consensus on a given block.

The flaw allows malicious validators to intentionally omit the block hash field when submitting their consensus vote. That field indicates which block each validator is voting on during the process. When it is missing, the system receives incomplete votes that lead to errors during critical verification checks.

Potential Impact of the Bug

The potential impact is concentrated at the network’s epoch boundaries. At those points, Babylon’s code attempts to process a vote without the corresponding hash and ends up dereferencing a null pointer in consensus-critical code paths. The result is a runtime panic that can cause active validators to crash.

The vulnerability was documented in a GitHub repository by the pseudonymous contributor GrumpyLaurie55348. The report notes that affected functions include VerifyVoteExtension and other vote checks performed during the block proposal phase. If multiple validators are affected at the same time, the network could experience a slowdown in block production, particularly during the creation of the block that marks the start of a new epoch.

So far, there are no records of the bug being actively exploited. However, developers warned that the behavior could be abused maliciously if the issue is not fixed. Babylon has not issued an official response at the time of writing.

Babylon Continues Working on Bitcoin DeFi Capabilities

Babylon is currently expanding its infrastructure focused on Bitcoin DeFi. The protocol is developing a Bitcoin-native staking system that will enable financial functionalities without the use of wrappers or custodians. In January, the protocol received $15 million in funding from a16z Crypto through the sale of its BABY token, with the funds allocated to the development of Bitcoin-native DeFi infrastructure.

In December, Babylon announced a partnership with Aave Labs to integrate Bitcoin-backed lending into Aave v4. The product will allow BTC to be used as direct collateral and is expected to enter its testing phase in the first quarter of 2026. Its joint launch is scheduled for April 2026