CVE-2026-54754

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.19

Description A time-of-check/time-of-use (TOCTOU) issue exists in the marketplace settlement process. While the system ensures that the combined referral and royalty percentages do not exceed 100% at the time of listing, the referral percentage is snapshotted while the royalty percentage is read live from the asset during purchase. An attacker can create a valid listing and subsequently increase the royalty percentage via the UpdateRoyalties function in the AssetTrigger module.

During settlement in core/kapp/market/market.go, the executeBuyMarket function pays referral and royalty amounts unconditionally. If the combined percentages exceed 100%, the computeMarketOwnerAmount function silently skips the resulting negative seller remainder. This allows the MarketBuy, BuyItNow, or auction Claim operations to credit more KLV or sale currency to the referral and royalty addresses than the buyer actually paid, effectively minting unbacked currency and corrupting the token supply.

This issue was actively exploited on the mainnet, where an attacker minted tens of millions of KLV and off-ramped approximately $72,000 to the Ethereum network.

Recommendations Update to version 1.7.19. As a temporary mitigation, restrict the use of the UpdateRoyalties function in the AssetTrigger module to prevent the modification of royalty percentages for active listings.