CVE-2025-61595: mantra-chain mantrachain Uncontrolled Resource Consumption
Vulnerability summary
CVE-2025-61595 is a high (CVSS 8.8) Uncontrolled Resource Consumption vulnerability in mantra-chain mantrachain. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 02-10-2025PublishedVulnerability first disclosed.
- 02-10-2025Last modifiedVulnerability information updated.
Description
MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. Versions 4.0.1 and below do not enforce the tx gas limit in its send hooks. Send hooks can spend more gas than what remains in tx, combined with recursive calls in the wasm contract, potentially amplifying the gas consumption exponentially. This is fixed in version 4.0.2.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
25%
Versus all other CVEs
30-day change
0.00 pp
From 0.33% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Github.com/MANTRA-Chain/mantrachain3 products
- v2All versions (No fix recorded)
- v3All versions (No fix recorded)
- v4< 4.0.2
Github.com/MANTRA-Chain1 product
- mantrachainAll versions (No fix recorded)
Mantra-chain1 product
- mantrachain< 4.0.2
3 vendors · 5 products
References
6 links- github.com/MANTRA-Chain/mantrachain/security/advisories/GHSA-qwvm-wqq8-8j69X Refsource CONFIRMWEBAdvisory
- github.com/MANTRA-Chain/mantrachain/commit/30d36c46e9823b56b8f0dcbb66e980ca5df284e4X Refsource MISCWEBFIX
