PT-2025-40050 · Go · Github.Com/Mantra-Chain/Mantrachain+3

Published 2025-09-30 · Updated 2025-09-30

OSV

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

send hooks can spend more gas than what's remained in tx, combined with recursive calls in the wasm contract, can amplify the gas consumption exponentially.

Patches

It's patched in v4.0.2 and v5.0.0

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

GHSA-QWVM-WQQ8-8J69

Affected Products

Github.Com/Mantra-Chain/Mantrachain

Github.Com/Mantra-Chain/Mantrachain/V2

Github.Com/Mantra-Chain/Mantrachain/V3

Github.Com/Mantra-Chain/Mantrachain/V4

References · 7

• https://osv.dev/vulnerability/GHSA-qwvm-wqq8-8j69 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61595 · Security Note
• https://github.com/MANTRA-Chain/mantrachain/security/advisories/GHSA-qwvm-wqq8-8j69 · Note
• https://github.com/MANTRA-Chain/mantrachain/issues/432 · Note
• https://github.com/MANTRA-Chain/mantrachain/commit/30d36c46e9823b56b8f0dcbb66e980ca5df284e4 · Note
• https://github.com/MANTRA-Chain/mantrachain · Note
• https://pkg.go.dev/vuln/GO-2025-3997 · Note