GitHub Advisoryadvisory · Go

GHSA-qwvm-wqq8-8j69 github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks

HIGH Published 2025-09-30 Modified 2025-10-23 Official page ↗
Aliases
CVE-2025-61595
Ecosystem
Go
Packages
github.com/MANTRA-Chain/mantrachain/v4, github.com/MANTRA-Chain/mantrachain/v3, github.com/MANTRA-Chain/mantrachain/v2, github.com/MANTRA-Chain/mantrachain
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-400, CWE-770
Reviewed
2025-09-30

Affected packages

• Go github.com/MANTRA-Chain/mantrachain/v4: < 4.0.2 → fixed in 4.0.2 • Go github.com/MANTRA-Chain/mantrachain/v3: < 4.0.2 (no fix yet) • Go github.com/MANTRA-Chain/mantrachain/v2: < 4.0.2 (no fix yet) • Go github.com/MANTRA-Chain/mantrachain: < 4.0.2 (no fix yet)

Description

Impact send hooks can spend more gas than what's remained in tx, combined with recursive calls in the wasm contract, can amplify the gas consumption exponentially. Patches It's patched in v4.0.2 and v5.0.0 Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_

Related

Alias · CVE (1)

  • CVE-2025-61595 MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References