CVE-2026-55763

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.19

Description An issue exists in the processPercentageRoyaltiesTransfer function within core/kapp/accounts/accounts.go where the royalty pool is debited from the sender using SubFromBalance only after the split distribution loop and an early return check. If a KDA owner configures a TransferPercentage royalty with a PercentTransferPercentage of exactly 10000 (100%), the royaltiesToPay variable reaches zero, triggering an early return before the sender is debited. This allows the split recipient to receive the full royalty amount without the sender paying anything and without updating the supply counter, resulting in unbounded off-the-books inflation of the transferred KDA. This minting occurs on any holder's transfer of the asset once configured. The processFixedRoyaltiesTransfer function is not affected as it debits the source before distribution.

Recommendations Update to version 1.7.19. As a temporary mitigation, avoid configuring TransferPercentage royalties with a 100% split.