PT-2025-40058 · Mantra · Mantra

Hellobloc · Published 2025-09-30 · Updated 2025-10-27 · CVE-2025-61595

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MANTRA versions prior to 4.0.2

Description The software does not enforce transaction gas limits within its send hooks. This allows send hooks to consume more gas than available in the transaction, and recursive calls within the WebAssembly (Wasm) contract can exponentially increase gas consumption. This issue affects a purpose-built Real World Asset (RWA) Layer 1 Blockchain designed to adhere to real-world regulatory requirements.

Recommendations Upgrade to version 4.0.2 or later.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2025-61595

GHSA-QWVM-WQQ8-8J69

GO-2025-3997

OPENSUSE-SU-2025:15666-1

SUSE-SU-2025:3799-1

Affected Products

Mantra

References · 50

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61595.json · Exploit
• https://osv.dev/vulnerability/GO-2025-3997 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61595 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61595 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qwvm-wqq8-8j69 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15666-1 · Vendor Advisory
• https://github.com/MANTRA-Chain/mantrachain/security/advisories/GHSA-qwvm-wqq8-8j69 · Note
• https://github.com/MANTRA-Chain/mantrachain/issues/432 · Note
• https://github.com/MANTRA-Chain/mantrachain/commit/30d36c46e9823b56b8f0dcbb66e980ca5df284e4 · Note
• https://github.com/MANTRA-Chain/mantrachain · Note
• https://suse.com/security/cve/CVE-2025-59350 · Note
• https://suse.com/security/cve/CVE-2025-59346 · Note
• https://suse.com/security/cve/CVE-2025-23266 · Note
• https://suse.com/security/cve/CVE-2024-58267 · Note