Description

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback, where txVersionChecker.CheckTxVersion dereferences tx.RawData.Version with no nil check. Because the libp2p pubsub callback, the underlying go-libp2p-pubsub validation worker, and Klever's own network/p2p layer install no recover(), the panic propagates and crashes the entire node process. The attacker payload is a 3-byte protobuf message; no validator key, stake, funds, or on-chain account is required, and delivery aimed at enough of the BLS validator set can halt block production, resulting in a chain halt. This issue has been fixed in version 1.7.18.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T23:17:04.593Z",
  "pubdate": "2026-08-07T23:17:04.593Z",
  "executiveSummary": "Klever-Go versions 1.7.14 through 1.7.17 are susceptible to a critical denial-of-service vulnerability classified as a nil-pointer panic. The flaw is triggered when processing a malformed protobuf Transaction in which the embedded RawData sub-message is intentionally omitted, resulting in a nil pointer upon decoding.\nThe vulnerability resides within the libp2p pubsub topic-validator callback mechanism where incoming transactions are synchronously decoded and validated. Specifically, the txVersionChecker.CheckTxVersion function attempts to dereference tx.RawData.Version without implementing a prior nil check. Because the libp2p pubsub callback, the underlying go-libp2p-pubsub validation worker, and Klever's internal network/p2p layer lack panic recovery routines, the uncaught exception propagates upward and terminates the entire node process.\nAn unauthenticated attacker can exploit this vulnerability with zero privileges, requiring no validator keys, stake, funds, or active on-chain accounts. By broadcasting a minimal 3-byte protobuf payload across the Klever-Go P2P network, an attacker can target the BLS validator set. Coordinated delivery to a sufficient number of validators causes widespread node crashes, halting block production and leading to a complete chain halt. The issue is fully resolved in version 1.7.18.",
  "technicalDetails": "The root cause of the vulnerability is the absence of defensive input validation and nil-pointer checks within the transaction validation pipeline of Klever-Go. Specifically, the vulnerable component is the transaction version checking logic executed inside the libp2p pubsub topic-validator callback.\nWhen a transaction is gossiped across the Klever-Go P2P network using libp2p, it is synchronously intercepted and processed by the topic-validator callback before propagation or inclusion in any mempool. During this phase, the raw byte stream is decoded into a protobuf Transaction message. If an attacker crafts a malicious 3-byte protobuf payload that omits the embedded RawData sub-message, the protobuf decoder initializes RawData as a nil pointer rather than an allocated structure.\nFollowing the decoding process, the validation routine invokes txVersionChecker.CheckTxVersion to evaluate the transaction version. Within this function, the code attempts to access tx.RawData.Version directly. Because RawData is nil, the memory dereference triggers a runtime nil-pointer panic in Go.\nThe attack flow proceeds as follows: 1) The attacker crafts a minimal 3-byte protobuf payload lacking the RawData field. 2) The attacker injects and gossips this payload onto the Klever-Go P2P network. 3) Target nodes receive the message via libp2p and trigger the synchronous pubsub topic-validator callback. 4) The payload successfully passes initial parsing but resolves to a nil RawData pointer. 5) The execution flow reaches txVersionChecker.CheckTxVersion, which attempts to read tx.RawData.Version. 6) A fatal nil-pointer panic occurs. 7) Due to the complete absence of recover() mechanisms in the libp2p pubsub callback, go-libp2p-pubsub worker, and Klever's p2p network layer, the panic is unhandled, crashing the host operating system process running the Klever-Go node.\nThe affected versions include Klever-Go 1.7.14 through 1.7.17. Exploitation requires network exposure to the P2P layer, but no authentication, cryptographic keys, staking assets, or prior on-chain standing are required. The post-exploitation impact is catastrophic at scale, as concurrent targeting of the BLS validator set stops consensus participation, directly resulting in a network-wide chain halt."
}