GHSA-qwvm-wqq8-8j69High

github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks

Published
September 30, 2025
Last Modified
October 23, 2025

🔗 CVE IDs covered (1)

CVE-2025-61595 →

📋 Description

Impact

send hooks can spend more gas than what's remained in tx, combined with recursive calls in the wasm contract, can amplify the gas consumption exponentially.

Patches

It's patched in v4.0.2 and v5.0.0

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

🎯 Affected products4

  • go/github.com/MANTRA-Chain/mantrachain/v4:< 4.0.2
  • go/github.com/MANTRA-Chain/mantrachain/v3:< 4.0.2
  • go/github.com/MANTRA-Chain/mantrachain/v2:< 4.0.2
  • go/github.com/MANTRA-Chain/mantrachain:< 4.0.2

🔗 References (6)