CVE-2026-54754

Klever-Go, the Go implementation of the Klever blockchain protocol, versions prior to 1.7.19 contain a settlement accounting flaw in core/kapp/market/market.go: the marketplace reads MarketOrderData.ReferralPercentage from the listing snapshot while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a valid listing and then use the AssetTrigger UpdateRoyalties function to raise royalties so the combined referral and royalty percentages exceed the buyer's bid; when MarketBuy, BuyItNow, or auction Claim settlement runs, executeBuyMarket pays the referral and royalty amounts unconditionally while computeMarketOwnerAmount silently skips a nonpositive seller remainder. The result is that the market credits more KLV or sale currency than the buyer actually paid, minting unbacked currency and corrupting the chain's token supply integrity, with the asset owner (or chosen referral/royalty recipients) capturing the inflated payout at the expense of all holders. Anyone operating a Klever-Go node before 1.7.19 is affected, and the economic impact extends to all users of the chain's marketplace and its currencies. No public proof of concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade all Klever-Go nodes to version 1.7.19 or later immediately, prioritizing validator and infrastructure operators. Operators should audit marketplace settlements (MarketBuy, BuyItNow, and auction Claim) on pre-1.7.19 nodes for payouts that exceeded buyer payments and monitor KLV and sale-currency supplies for unbacked minting. Until patched, treat marketplace listings as susceptible to seller-side royalty inflation via AssetTrigger UpdateRoyalties.