# Any covenant committee member can prevent all BTC stakers from successfully constructing a valid Unbonding Transaction

A malicious covenant committee member returns an invalid signature early; the staker includes it in the quorum without verification, producing an invalid Unbonding Transaction that Babylon rejects.

- Payout: Contest reward
- Severity: medium
- Program: Babylon
- Credited: poetyellow-scalebit
- Disclosed: 2024-08-04
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_babylon_may2024.pdf#3.2.9
- Library page: https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.9
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:signature-replay

**Target:** CLI Tools unbonding pipeline (requestSigFromCovenant)
**Root cause:** The staker collects covenant signatures by arrival order into the quorum without verifying each signature's correctness before assembling the Unbonding Transaction.
**Steps:**
1. Staker requests signatures from all covenant committee members via requestSigFromCovenant.
2. Malicious member returns an incorrect signature immediately (no computation needed).
3. Staker includes the invalid signature in the quorum set (unbonding_pipeline.go#186).
4. Staker uploads the assembled Unbonding Transaction to Babylon.
5. Babylon rejects the transaction as invalid, blocking unbonding.
**How found:** Reviewer read the unbonding pipeline code and noticed signatures are collected by arrival order without correctness verification at unbonding_pipeline.go#186, then reasoned a fast invalid response would win a quorum slot.
**Exploitation:** A single malicious covenant committee member responds early with a bogus signature; because responses are accepted in arrival order and unverified, the invalid signature occupies a quorum slot, making the staker's Unbonding Transaction permanently invalid.
**Insight:** When a client aggregates threshold signatures by arrival order, check whether each partial signature is verified before counting toward quorum; a fast invalid response can poison the set.