MANTRA Chain Resumes Operations After Security Halt, Code Changes Raise Questions

MANTRA Chain has successfully restored mainnet block production using version 8.4.0, marking its return six days after a security incident compelled a network-wide pause. However, the chain’s developers have yet to release a detailed technical account of the event, leaving key aspects—such as the exploitation of an upstream dependency and activities within two project-managed wallets—unexplained.

According to the official incident timeline, mainnet services resumed at approximately 05:30 UTC on August 22. The team confirmed that no rollback or state changes occurred during the halt and restart process, ensuring user balances remained intact and requiring no action from token holders.

The MANTRA team declared the incident resolved on August 24 but indicated that a comprehensive postmortem would be published in the following days. As of August 27, neither the project’s status page nor its official announcement channels had provided a link to this report.

MANTRA stated that its investigation determined the incident affected two MANTRA-managed wallets, emphasizing that no user, exchange, or partner funds were compromised. However, the public disclosure stops short of detailing specific wallet addresses, transaction hashes, monetary amounts, or the precise steps involved in the exploit.

When the network halt was first reported on August 21, patch testing was still in progress. While the network’s revival addresses immediate operational concerns, it does not shed light on the attacker’s methodology or MANTRA’s broader containment strategy.

For node operators, identifying the correct v8.4.0 build is now critical. The current release page directs to full commit 5c08d7bd9e2619952707dae1258d2a30bf024721; however, MANTRA has cautioned that this tag was re-pushed during the recovery phase and advises operators to re-sync accordingly.

The release changelog reveals an intermediate MANTRA EVM fork update—from v0.6.0-v8-mantra-3 to v0.6.0-v8-mantra-4—followed by a final tagged go.mod that substitutes the dependency with the chain’s v0.6.2-v8-mantra-1 fork.

The implemented mitigation includes a final upgrade handler that blocks a single address and disables three Cosmos vesting-account creation messages via the circuit breaker. These measures confirm the deployed response while continuing to obscure the underlying attack vector.

Why the March ICS20 Vulnerability Remains Theoretical for MANTRA Users

A March advisory from Cosmos Labs outlined a critical ICS20 precompile vulnerability, noted that affected chains had either mitigated or upgraded, and listed Mantra among those cooperating on remediation. However, the advisory’s scope concluded with the March disclosure, leaving the August incident outside its documented parameters.

Users can independently verify the restart, inspect the finalized codebase, and review the stated impact. However, additional transparency—including wallet addresses, transaction hashes, financial figures, and a detailed technical explanation—is essential to fully trace the incident’s implications and assess whether it mirrors the previously identified ICS20 flaw.

Source link