fkie_cve-2026-54755

2026-09-29T18:17:41.407057+00:00

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32 accumulators. Crafted values such as two 0x80000000 entries wrap the validation sum to zero and pass CheckValid100Params. Royalty payout paths in core/kapp/accounts/accounts.go, core/kapp/market/market.go, and core/kapp/ito/ito.go then credit each oversized split amount and silently discard a negative remainder, allowing ordinary asset transfers, marketplace purchases, or ITO purchases to create unbacked KLV or other assets. This issue is fixed in version 1.7.19.

GHSA-cgc5-v3f2-8m2v — Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

2026-09-29T18:17:41.407182+00:00

Affected: Go: github.com/klever-io/klever-go

## Summary

The per-entry percentages of a KDA asset's **split royalties** are validated by summing them into a **`uint32`** accumulator and checking the *sum* against `HundredPercent (10000)`, with **no upper bound on each individual entry**. Two split entries whose percentages sum to just over `2^32` **wrap around** below `10000` and pass validation, while each stored value remains astronomically large (e.g. `0x80000000 = 2,147,483,648` ≈ 21,474,836%).

At royalty payout, each split recipient is credited `pool × hugePct / 10000` — far more than the royalty pool — and the resulting negative remainder is silently discarded (`if royaltiesToPay <= 0 { return Ok }`). Because **fixed** royalties (and marketplace/ITO royalties) are denominated in **KLV**, an attacker mints **KLV (the native token)** out of thin air, on demand, by transferring or selling their own throwaway asset.

This is independent of, and not mitigated by, the existing `FixMarketBuyOverflow` guard.

## Affected component

- Repository: `klever-io/klever-go` (node). - Validation: `core/process/kda/assetHelper.go`, `core/kapp/kda/create.go`, `core/kapp/kda/trigger.go`, `core/kapp/builtInFunctions/utils.go`. - Payout (mint sites): `core/kapp/accounts/accounts.go` (transfer), `core/kapp/market/market.go` (marketplace buy), `core/kapp/ito/ito.go` (ITO buy). - **Not** gated by any fork flag — exploitable on current mainnet.

---

## Root cause

### 1. Per-entry split percentages are decoded as raw `uint32` with…

Most recent entries from all

fkie_cve-2026-54755

GHSA-cgc5-v3f2-8m2v — Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)