CVE-2026-54755

Klever-Go, the Go implementation of the Klever blockchain protocol, mishandles split-royalty validation: royalty values greater than 100% are permitted, and the sums used by CheckValid100Params are accumulated in uint32 variables, so crafted values such as two 0x80000000 entries wrap to zero and pass validation. Any account able to initiate ordinary asset transfers, marketplace purchases, or ITO purchases can trigger the flaw, causing the payout logic in the accounts, market, and ITO modules to credit each oversized split amount while silently discarding the negative remainder. The attacker gains the creation of unbacked KLV or other assets out of thin air, corrupting ledger integrity; the critical 9.6 CVSS score reflects high integrity and availability impact with changed scope. Operators running Klever-Go versions prior to 1.7.19 are affected, and because the flaw affects core asset-accounting paths, the resulting inflation would impact all users of the chain, not just the triggering account. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS puts the 30-day exploitation probability at roughly 0.4%.

What to do: Upgrade all Klever-Go nodes to version 1.7.19 or later as a priority, since no workaround for the uint32 wraparound is described. Until patched, monitor chain state and account balances for unexplained increases in KLV or other asset supplies, and scrutinize transactions carrying unusually large royalty-split values. No public PoC or in-the-wild exploitation is currently known, but treat the fix as urgent given the critical severity and the protocol's economic exposure.