MANTRA tx gas limit is not enforced in send hooks
Priority LOW 38CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- Low · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. Versions 4.0.1 and below do not enforce the tx gas limit in its send hooks. Send hooks can spend more gas than what remains in tx, combined with recursive calls in the wasm contract, potentially amplifying the gas consumption exponentially. This is fixed in version 4.0.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00334 26th percentileScored 2026-11-07
Fix Fixed mantrachain (MANTRA-Chain): 4.0.2github.com/MANTRA-Chain/mantrachain/v4 (Go): 4.0.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MANTRA-Chain | mantrachain | before 4.0.2 | 4.0.2 | Patch available | CNA |
| — | github.com/MANTRA-Chain/mantrachain/v4 (Go) | before 4.0.2 | 4.0.2 | Patch available | GHSA-qwvm-wqq8-8j69 |
| — | github.com/MANTRA-Chain/mantrachain/v3 (Go) | all versions | — | No fix listed | GHSA-qwvm-wqq8-8j69 |
| — | github.com/MANTRA-Chain/mantrachain/v2 (Go) | all versions | — | No fix listed | GHSA-qwvm-wqq8-8j69 |
| — | github.com/MANTRA-Chain/mantrachain (Go) | all versions | — | No fix listed | GHSA-qwvm-wqq8-8j69 |
- mantrachain VendorMANTRA-Chain Affected before 4.0.2 Fixed in 4.0.2 Patch available CNA
- github.com/MANTRA-Chain/mantrachain/v4 (Go) Vendor— Affected before 4.0.2 Fixed in 4.0.2 Patch available GHSA-qwvm-wqq8-8j69
- github.com/MANTRA-Chain/mantrachain/v3 (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-qwvm-wqq8-8j69
- github.com/MANTRA-Chain/mantrachain/v2 (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-qwvm-wqq8-8j69
- github.com/MANTRA-Chain/mantrachain (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-qwvm-wqq8-8j69
Remediation
- Fix · CNA mantrachain (MANTRA-Chain) Fixed in 4.0.2
- Fix · GHSA-qwvm-wqq8-8j69 github.com/MANTRA-Chain/mantrachain/v4 (Go) Fixed in 4.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-61595
- 2026-10-03 Alias added: GHSA-qwvm-wqq8-8j69
References
Other 5
- https://github.com/MANTRA-Chain/mantrachain/security/advisories/GHSA-qwvm-wqq8-8j69
- https://github.com/MANTRA-Chain/mantrachain/commit/30d36c46e9823b56b8f0dcbb66e980ca5df284e4
- https://github.com/MANTRA-Chain/mantrachain/issues/432
- https://github.com/MANTRA-Chain/mantrachain
- https://pkg.go.dev/vuln/GO-2025-3997
Sources
- CVE-2025-61595 · CVE Program
- CVE-2025-61595 · NVD
- FIRST EPSS
- GHSA-qwvm-wqq8-8j69 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences