Description

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32 accumulators. Crafted values such as two 0x80000000 entries wrap the validation sum to zero and pass CheckValid100Params. Royalty payout paths in core/kapp/accounts/accounts.go, core/kapp/market/market.go, and core/kapp/ito/ito.go then credit each oversized split amount and silently discard a negative remainder, allowing ordinary asset transfers, marketplace purchases, or ITO purchases to create unbacked KLV or other assets. This issue is fixed in version 1.7.19.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-28T20:18:17.670Z",
  "pubdate": "2026-08-28T20:18:17.670Z",
  "executiveSummary": "Klever-Go versions prior to 1.7.19 contain a critical integer overflow vulnerability within the split-royalty decoding and validation logic.\nThe flaw originates from insufficient bounds checking on royalty percentage values during the decoding process, allowing values exceeding core.HundredPercent to be processed.\nThe vulnerability resides in the core/kapp/builtInFunctions/utils.go, core/kapp/kda/create.go, and core/kapp/kda/trigger.go components, where these values are aggregated using uint32 accumulators.\nAn attacker can exploit this by crafting specific split-royalty entries that trigger integer wrapping—specifically, values that sum to multiples of 0x100000000—to bypass the CheckValid100Params validation routine.\nSuccessful exploitation allows for the unauthorized creation of unbacked assets, including KLV, by manipulating the royalty distribution logic in core/kapp/accounts/accounts.go, core/kapp/market/market.go, and core/kapp/ito/ito.go.\nThe system fails to correctly validate the cumulative royalty percentages, leading to a scenario where negative remainders are discarded, enabling fraudulent balance increases during asset transfers, marketplace activities, or ITO purchases.\nThis vulnerability poses a significant risk to the integrity of the blockchain ledger and asset supply.",
  "technicalDetails": "The vulnerability is primarily rooted in an improper validation of input data regarding split-royalty configurations. Within core/kapp/builtInFunctions/utils.go, the system decodes royalty fields without enforcing strict compliance with the core.HundredPercent constant. Consequently, the decoded values can represent percentages significantly larger than the intended maximum capacity of the royalty system.\nThe exploitation flow begins when an attacker submits transactions containing maliciously crafted split-royalty parameters. These parameters are subsequently processed in core/kapp/kda/create.go and core/kapp/kda/trigger.go. In these modules, the royalty values are aggregated into uint32 accumulators. By injecting multiple values such as 0x80000000, the attacker forces the accumulator to overflow. Because the sum wraps around to zero, the result effectively bypasses the CheckValid100Params function, which expects the total royalty share to equal exactly 100%.\nOnce the malicious royalty configuration passes the validation check, it is stored in the blockchain state. The vulnerability manifests during the payout phase within core/kapp/accounts/accounts.go, core/kapp/market/market.go, and core/kapp/ito/ito.go. When these modules execute the payout logic, they attempt to credit the oversized split amount to the designated accounts. Due to the overflowed state, the logic generates a calculation error. The system incorrectly credits the excessive royalty values while silently discarding the negative remainders generated by the overflow discrepancy.\nThis behavior results in the arbitrary creation of unbacked assets within the ecosystem. The impact is severe, as an attacker can manipulate standard protocol operations—such as marketplace purchases or ITO participations—to inflate their own account balances at the expense of the protocol's total supply integrity. The flaw affects the core logic of asset distribution, making it an application-layer vulnerability that exploits the way the Go runtime handles arithmetic operations on fixed-width unsigned integers. The vulnerability requires no special privileges other than the ability to participate in protocol functions that utilize split-royalty fields, such as KDA creation or marketplace trading. The lack of proper checked arithmetic or robust pre-validation allows the crafted payload to propagate through the system's state machine, leading to unauthorized state transitions that permanently alter the balances of the affected assets."
}