PT-2025-40050 · Go · Github.Com/Mantra-Chain/Mantrachain+3

Publicado 2025-09-30 · Atualizado 2025-09-30

OSV

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

send hooks can spend more gas than what's remained in tx, combined with recursive calls in the wasm contract, can amplify the gas consumption exponentially.

Patches

It's patched in v4.0.2 and v5.0.0

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Correção

Allocation of Resources Without Limits

Resource Exhaustion

Enumeração de Fraquezas

CWE-770

CWE-400

Identificadores relacionados

GHSA-QWVM-WQQ8-8J69

Produtos afetados

Github.Com/Mantra-Chain/Mantrachain

Github.Com/Mantra-Chain/Mantrachain/V2

Github.Com/Mantra-Chain/Mantrachain/V3

Github.Com/Mantra-Chain/Mantrachain/V4

Referências · 7

• https://github.com/MANTRA-Chain/mantrachain/security/advisories/GHSA-qwvm-wqq8-8j69 · Nota
• https://github.com/MANTRA-Chain/mantrachain/issues/432 · Nota
• https://github.com/MANTRA-Chain/mantrachain/commit/30d36c46e9823b56b8f0dcbb66e980ca5df284e4 · Nota
• https://github.com/MANTRA-Chain/mantrachain · Nota
• https://pkg.go.dev/vuln/GO-2025-3997 · Nota
• https://osv.dev/vulnerability/GHSA-qwvm-wqq8-8j69 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-61595 · Nota de Segurança