CVE-2025-61595: 
vulnerability analysis and mitigation

CVE-2025-61595 is an uncontrolled resource consumption vulnerability in the MANTRA blockchain's x/tokenfactory module where transaction gas limits are not enforced in send hooks. Affecting github.com/MANTRA-Chain/mantrachain versions prior to 4.0.2 (all v1–v4 module paths), the flaw allows send hooks to consume more gas than what remains in a transaction, and when combined with recursive WebAssembly (WASM) contract calls, can amplify gas consumption exponentially. The vulnerability was reported by researcher Hellobloc on August 29, 2025, and publicly disclosed via a GitHub Security Advisory on September 30, 2025. It carries a CVSS v4 base score of 8.8 (High) (Github Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). In the vulnerable code path (x/tokenfactory/keeper/before_send.go), the child context passed to the WASM contract's Sudo call was created with a fixed BeforeSendHookGasLimit rather than being capped to the gas remaining in the parent transaction. This means a malicious or misconfigured WASM contract registered as a send hook could recursively invoke itself or other contracts, each time consuming up to the full hook gas limit, causing exponential gas amplification beyond the original transaction's budget. No authentication or special privileges are required — any network participant can submit a crafted transaction targeting a token with a vulnerable send hook (Github Advisory, Patch Commit).

Successful exploitation can cause denial-of-service conditions on the MANTRA blockchain by exhausting computational resources through exponentially amplified gas consumption. This primarily impacts availability of the blockchain network's transaction processing capabilities, potentially stalling or degrading block production. There is a low confidentiality impact noted in the CVSS scoring, though the primary risk is resource exhaustion affecting all network participants (Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is remotely exploitable with no privileges required and no user interaction needed, making it relatively easy to trigger by any network participant who can submit transactions. The EPSS score is approximately 0.077% (23rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Identify a vulnerable target: Confirm the target MANTRA blockchain node is running mantrachain version 4.0.1 or earlier by querying the node's version endpoint or inspecting the go.mod of the deployed binary.
2. Deploy or identify a malicious WASM contract: Deploy a CosmWasm smart contract that, when its sudo entry point is called (as triggered by a send hook), recursively calls back into itself or another contract, maximizing gas consumption per invocation.
3. Register the contract as a send hook: Using the x/tokenfactory module, create or control a token denom and register the malicious WASM contract as its BeforeSend hook via the appropriate MsgSetBeforeSendHook transaction.
4. Trigger the send hook: Submit a token transfer transaction for the controlled denom. The callBeforeSendListener function will invoke the WASM contract's Sudo with a child context using the full BeforeSendHookGasLimit regardless of remaining gas, enabling recursive amplification.
5. Achieve resource exhaustion: The recursive WASM calls consume gas exponentially beyond the transaction's original gas budget, potentially causing node-level resource exhaustion and denial of service on the blockchain (Github Advisory, Patch Commit).

• Blockchain Transactions: Transactions involving token denoms with registered BeforeSend hooks that consume anomalously high gas relative to the declared gas limit; transactions that fail with out-of-gas errors in the x/tokenfactory send hook execution path.
• Node Logs: Repeated log entries referencing failed to call before send hook errors or excessive WASM execution time in x/tokenfactory/keeper/before_send.go; node performance degradation or block processing delays coinciding with specific transaction patterns.
• Network: Unusual volume of token transfer transactions targeting a specific denom with a registered WASM send hook from a single or small set of addresses.

The fix is available in MANTRA blockchain version 4.0.2 and 5.0.0. The patch (commit 30d36c4) modifies x/tokenfactory/keeper/before_send.go to cap the child context gas limit to the minimum of BeforeSendHookGasLimit and the remaining gas in the parent transaction (min(types.BeforeSendHookGasLimit, c.GasMeter().GasRemaining())), preventing hooks from consuming more gas than available. No official workaround exists for users who cannot upgrade immediately; node operators should prioritize upgrading to v4.0.2 or v5.0.x. Additionally, monitoring for unusual gas consumption patterns in transactions involving tokenfactory send hooks is recommended as a detection measure (Github Advisory, Patch Commit).

The vulnerability was reported by security researcher Hellobloc via GitHub issue #432 on August 29, 2025, and the advisory was published by MANTRA-Chain maintainer yihuang on September 30, 2025. No significant broader media coverage or notable public researcher commentary beyond the GitHub advisory has been identified (Github Advisory, MANTRA Issue).