N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-61595

CVE-2025-61595: github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks

Impact

send hooks can spend more gas than what's remained in tx, combined with recursive calls in the wasm contract, can amplify the gas consumption exponentially.

Patches

It's patched in v4.0.2 and v5.0.0

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-61595

CVE-2025-61595:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/MANTRA-Chain/mantrachain/v4	go	< 4.0.2	4.0.2
github.com/MANTRA-Chain/mantrachain/v3	go	< 4.0.2
github.com/MANTRA-Chain/mantrachain/v2	go	< 4.0.2
github.com/MANTRA-Chain/mantrachain	go	< 4.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the incorrect enforcement of gas limits for send hooks within the tokenfactory module. A malicious actor could create a wasm contract with a send hook that triggers a large amount of computation, potentially in a recursive manner, to consume far more gas than allocated to the transaction. This could lead to a denial-of-service condition on the chain.

The investigation started by examining the provided issue URL, which did not yield direct commit information. Subsequently, I analyzed the repository tags to pinpoint the commits related to the patched version v4.0.2. The commit tagged as v4.0.2 was only a Go version bump, so I expanded the search to commits between v4.0.1 and v4.0.2. This led to the identification of commit a4744a12a3c4bf79eb17d963f193056d173d1568, which references the issue mentioned in the security advisory.

The analysis of this commit revealed changes in x/tokenfactory/keeper/before_send.go. The function callBeforeSendListener was modified to replace the flawed gas metering logic. The original code created a new gas meter for the hook execution, which did not properly constrain the gas usage within the limits of the parent transaction. The fix involves using a new ProxyGasMeter that wraps the original gas meter, ensuring that any gas consumed by the hook is correctly accounted for and limited by the transaction's overall gas limit. The vulnerable function is Keeper.callBeforeSendListener as it contained the logic that failed to properly enforce the gas limit.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.