CVE-2025-61595 MANTRA tx gas limit is not enforced in send hooks
Attackers can cause denial of service by exploiting unenforced gas limits in send hooks, leading to exponential gas consumption via recursive calls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-61595?
CVE-2025-61595 is a high-severity denial of service vulnerability in MANTRA-Chain mantrachain, published on 2 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. Versions 4.0.1 and below do not enforce the tx gas limit in its send hooks. Send hooks can spend more gas than what remains in tx, combined with recursive calls in the wasm contract, potentially amplifying the gas consumption exponentially. This is fixed in version 4.0.2.
Which versions are affected by CVE-2025-61595?
12 open source packages ship an affected version, including github.com/MANTRA-Chain/mantrachain, github.com/MANTRA-Chain/mantrachain/v2 and github.com/MANTRA-Chain/mantrachain/v3.
| Package | Affected | Fixed in |
|---|---|---|
github.com/MANTRA-Chain/mantrachain Go | All versions | None |
github.com/MANTRA-Chain/mantrachain Go | All versions | None |
github.com/MANTRA-Chain/mantrachain Go | All versions | None |
github.com/MANTRA-Chain/mantrachain/v2 Go | All versions | None |
github.com/MANTRA-Chain/mantrachain/v2 Go | All versions | None |
github.com/MANTRA-Chain/mantrachain/v2 Go | All versions | None |
6 more packages
github.com/MANTRA-Chain/mantrachain/v3 Go | All versions | None |
github.com/MANTRA-Chain/mantrachain/v3 Go | All versions | None |
github.com/MANTRA-Chain/mantrachain/v3 Go | All versions | None |
github.com/MANTRA-Chain/mantrachain/v4 Go | All versions | 4.0.2 |
github.com/MANTRA-Chain/mantrachain/v4 Go | All versions | 4.0.2 |
github.com/MANTRA-Chain/mantrachain/v4 Go | All versions | 4.0.2 |
How do I fix CVE-2025-61595?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-61595 being exploited?
There is no known exploitation of CVE-2025-61595 in the wild and no public exploit code.
Sources
Also known as GHSA-qwvm-wqq8-8j69, GO-2025-3997.