mantra-chain/mantrachain · Security
github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks
- GHSA ID
- GHSA-qwvm-wqq8-8j69
- CVE ID
- CVE-2025-61595
- Severity
- high
- Published
- Updated
- CVSS v4
- 8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Description
Impact
send hooks can spend more gas than what's remained in tx, combined with recursive calls in the wasm contract, can amplify the gas consumption exponentially.
Patches
It's patched in v4.0.2 and v5.0.0
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
CWEs
- CWE-400 · Uncontrolled Resource Consumption
- CWE-770 · Allocation of Resources Without Limits or Throttling
References
- https://github.com/MANTRA-Chain/mantrachain/security/advisories/GHSA-qwvm-wqq8-8j69 ↗
- https://github.com/MANTRA-Chain/mantrachain/issues/432 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-61595 ↗
- https://github.com/MANTRA-Chain/mantrachain/commit/30d36c46e9823b56b8f0dcbb66e980ca5df284e4 ↗
- https://pkg.go.dev/vuln/GO-2025-3997 ↗
- https://github.com/advisories/GHSA-qwvm-wqq8-8j69 ↗