CVE-2025-61595: MANTRA Blockchain DOS Vulnerability

CVE-2025-61595 Overview

CVE-2025-61595 affects MANTRA Chain, a purpose-built Real World Asset (RWA) Layer 1 blockchain designed for regulatory compliance. The vulnerability resides in the x/tokenfactory module, where send hooks fail to enforce the transaction gas limit. Send hooks can consume more gas than what remains in the parent transaction. Combined with recursive calls inside CosmWasm contracts, this can amplify gas consumption exponentially and disrupt chain liveness. MANTRA Chain versions 4.0.1 and earlier are affected, and the issue is patched in version 4.0.2. The flaw maps to [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
A remote, unauthenticated attacker can craft transactions that recursively trigger token factory send hooks, exhausting node resources and degrading availability across the MANTRA Chain network.

Affected Products

MANTRA Chain (mantrachain) versions 4.0.1 and below
Token Factory module (x/tokenfactory) send hook execution path
Validator and full-node operators running vulnerable mantrachain releases

Discovery Timeline

2025-10-02 - CVE-2025-61595 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-61595

Vulnerability Analysis

The vulnerability stems from improper gas accounting in the token factory BeforeSend hook dispatcher. When a transfer triggers a send hook, the keeper creates a child context with a new gas meter initialized to BeforeSendHookGasLimit. The implementation does not compare this constant against the gas remaining in the parent transaction context. As a result, a send hook can consume the full BeforeSendHookGasLimit even when the parent transaction has nearly exhausted its gas budget.

When the send hook invokes a CosmWasm contract via contractKeeper.Sudo, the contract can issue further token transfers. Each nested transfer spawns another child context with a fresh gas allotment. Recursive transfer logic inside the contract amplifies gas usage exponentially relative to the gas the attacker paid for. This breaks the economic guarantees that bound block computation.

Root Cause

The root cause is the absence of a min() comparison between the hook-specific gas constant and the remaining parent gas. The child gas meter ignores the parent meter state, so recursion through send hooks does not honor the transaction-level gas limit defined by the consensus parameters.

Attack Vector

An attacker deploys a CosmWasm contract registered as a BeforeSend hook for a token factory denom. The attacker then submits a single transfer transaction with minimal gas. The contract issues additional self-referential transfers, each one re-entering the hook dispatcher with a full BeforeSendHookGasLimit allowance. This pattern enables resource exhaustion on validating nodes and can stall block production.

// Patch from x/tokenfactory/keeper/before_send.go
// Source: https://github.com/MANTRA-Chain/mantrachain/commit/30d36c46e9823b56b8f0dcbb66e980ca5df284e4

            }
            em := sdk.NewEventManager()

-           childCtx := c.WithGasMeter(types2.NewGasMeter(types.BeforeSendHookGasLimit))
+           newGasLimit := min(types.BeforeSendHookGasLimit, c.GasMeter().GasRemaining())
+           childCtx := c.WithGasMeter(types2.NewGasMeter(newGasLimit))
            _, err = k.contractKeeper.Sudo(childCtx.WithEventManager(em), cwAddr, msgBz)
            if err != nil {
                return errorsmod.Wrapf(err, "failed to call before send hook for denom %s", coin.Denom)

The patch enforces min(BeforeSendHookGasLimit, GasRemaining()), ensuring the child context inherits the upper bound of the parent transaction.

Detection Methods for CVE-2025-61595

Indicators of Compromise

Transactions producing block gas consumption substantially exceeding the declared tx gas limit
Repeated Sudo invocations against the same CosmWasm contract address tied to a token factory denom
Validator logs reporting prolonged block execution times or missed proposer slots correlated with token factory transfers

Detection Strategies

Audit recent MsgSend, MsgTransfer, and token factory transactions for denoms with registered BeforeSend hooks and unusually deep call stacks
Compare reported transaction gas usage against actual node CPU and wall-clock execution time for outliers
Review on-chain CosmWasm contract code registered as send hooks for recursive transfer patterns

Monitoring Recommendations

Track validator block production latency and missed-block counters during periods of elevated token factory activity
Alert on transactions where cumulative hook gas across child contexts exceeds the parent transaction gas limit
Forward mantrachain node telemetry and consensus logs to a centralized analytics platform for cross-validator correlation

How to Mitigate CVE-2025-61595

Immediate Actions Required

Upgrade all MANTRA Chain validators and full nodes to mantrachain version 4.0.2 or later
Coordinate with the validator set to ensure synchronous upgrade timing and avoid consensus splits
Review and, where feasible, restrict creation of new token factory BeforeSend hooks until upgrade is complete

Patch Information

The fix is committed in MANTRA-Chain mantrachain commit 30d36c4 and released in version 4.0.2. Additional details are documented in the GHSA-qwvm-wqq8-8j69 security advisory. The patch enforces the parent gas meter's remaining budget as the upper bound for hook execution.

Workarounds

No supported workaround replaces the patch; operators should upgrade to 4.0.2
Validators may temporarily reduce block gas limits via governance to constrain worst-case hook recursion
Monitor governance channels for emergency parameter changes affecting tokenfactory send hooks

bash

# Verify mantrachain version on a node
mantrachaind version --long | grep -E 'version|commit'

# Expected output should report version 4.0.2 or later
# version: 4.0.2