CVE-2026-54755 in Klever-Go
Summary
by MITRE • 08/28/2026
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32 accumulators. Crafted values such as two 0x80000000 entries wrap the validation sum to zero and pass CheckValid100Params. Royalty payout paths in core/kapp/accounts/accounts.go, core/kapp/market/market.go, and core/kapp/ito/ito.go then credit each oversized split amount and silently discard a negative remainder, allowing ordinary asset transfers, marketplace purchases, or ITO purchases to create unbacked KLV or other assets. This issue is fixed in version 1.7.19.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The Klever-Go blockchain protocol implementation contains a critical integer overflow vulnerability within its royalty distribution logic that allows for the creation of unbacked digital assets and unauthorized token minting. The flaw resides specifically in how split-royalty fields are decoded and validated before being processed by various application modules including account management, marketplace transactions, and initial token offerings. In versions prior to 1.7.19, the validation logic fails to enforce strict upper bounds on royalty percentages relative to a hundred percent baseline. This oversight permits crafted inputs containing values that exceed one hundred percent when aggregated, leading to severe financial integrity breaches within the blockchain ecosystem.
The technical root cause involves improper handling of unsigned integer arithmetic in Go language implementations where wraparound behavior is inherent to fixed-size types like uint32. Specifically, functions located in core/kapp/builtInFunctions/utils.go decode split-royalty fields without sufficient range checking against a maximum threshold defined as core.HundredPercent. Subsequently, the modules responsible for creating and triggering royalty distributions, found in core/kapp/kda/create.go and core/kapp/kda/trigger.go respectively, accumulate these decoded values using uint32 accumulators. When an attacker provides crafted split parameters such as two entries each valued at 0x80000000, the sum of these values exceeds the maximum capacity of a thirty-two-bit unsigned integer. This causes the accumulator to wrap around to zero due to standard modular arithmetic behavior inherent in uint32 operations.
This overflow condition effectively bypasses the CheckValid100Params validation function which relies on this accumulated sum to ensure that total royalty splits do not exceed one hundred percent. Because the wrapped value appears valid, the system proceeds with executing payout logic across multiple critical paths including core/kapp/accounts/accounts.go for general asset transfers, core/kapp/market/market.go for marketplace purchases, and core/kapp/ito/ito.go for initial token offering transactions. During these operations, each oversized split amount is credited to recipient accounts while the negative remainder resulting from the overflow is silently discarded rather than triggering an error or rejection of the transaction.
The operational impact of this vulnerability is severe as it allows attackers to generate unbacked KLV tokens or other native assets through ordinary economic activities on the platform. By exploiting the integer wraparound, malicious actors can manipulate royalty calculations to receive payouts that exceed the actual value being transacted, effectively minting new currency out of thin air without corresponding collateral or backing. This undermines the fundamental monetary policy and trust model of the Klever blockchain, potentially leading to inflationary pressures, loss of investor confidence, and significant financial losses for legitimate participants who rely on the integrity of asset valuations and transaction finality.
To mitigate this vulnerability, users must upgrade immediately to version 1.7.19 or later where the integer overflow issue has been resolved through stricter input validation and proper arithmetic checks that prevent wraparound exploitation. Developers integrating with Klever-Go should also implement defensive programming practices such as using safe math libraries that detect overflows before they occur rather than relying on silent wrapping behavior. Furthermore, auditing smart contract logic for similar patterns in other blockchain implementations is recommended to ensure robustness against integer manipulation attacks across the broader decentralized finance ecosystem. This incident highlights the importance of rigorous validation boundaries and secure arithmetic handling in financial protocol design to prevent catastrophic failures stemming from basic programming language characteristics like unsigned integer overflow.