CVE-2026-55763

Klever-Go, the Go implementation of the Klever blockchain protocol, contains a logic-ordering flaw in processPercentageRoyaltiesTransfer (core/kapp/accounts/accounts.go) where the sending account is debited only after the royalty split loop and after an early return when royaltiesToPay reaches zero. An attacker who owns a KDA asset can configure a TransferPercentage royalty with a 10000 (100%) split, which consumes the entire royalty pool, sets royaltiesToPay to zero, and causes the function to return before the source account is ever debited. Every subsequent transfer of that asset then delivers the full royaltyAmount to the split recipient while the sender pays nothing and the supply counter is not updated, enabling unbounded off-the-books inflation of the transferred KDA at the asset owner's discretion. Anyone operating a Klever chain node or embedding klever-go versions prior to 1.7.19 is affected; the sibling processFixedRoyaltiesTransfer path is not impacted because it debits the sender before distributing. No public proof-of-concept or in-the-wild exploitation is known, the issue is not in CISA KEV, and EPSS currently estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade klever-go to version 1.7.19 or later, and have node operators and any services embedding the library rebuild and redeploy with the patched version. Audit configured KDA assets for TransferPercentage royalties set to a 100% split, since transfers of such assets trigger the uncosted mint, and monitor KDA supply accounting for off-the-books inflation. Note that only the percentage-royalty transfer path is affected, so assets using fixed royalties do not need remediation beyond the standard upgrade.