CVE-2026-54755

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.19

Description An integer overflow exists in the handling of split-royalty fields. The software validates split royalties by summing them into a uint32 accumulator and checking if the total is within core.HundredPercent (10000), but it fails to enforce an upper bound on individual entries. An attacker can provide two entries that sum to just over 2^32, causing the uint32 sum to wrap around to a small value that passes validation while the individual stored values remain extremely large.

During royalty payouts, the system credits recipients based on these oversized values. Because the payout logic silently discards negative remainders, this allows for the unauthorized minting of KLV (the native token) or other assets during ordinary asset transfers, marketplace purchases, or ITO purchases. This inflation occurs via direct balance additions and does not update the official circulating supply, making it difficult to detect.

Technical details include:

Recommendations Update Klever-Go to version 1.7.19. As a temporary mitigation, restrict the creation of new assets or the updating of royalties until the update is applied.