CVE-2026-54754: Klever-Go Privilege Escalation Vulnerability

CVE-2026-54754 Overview

Klever-Go, the Go implementation of the Klever blockchain protocol, contains a critical business logic flaw in marketplace settlement logic prior to version 1.7.19. The flaw resides in core/kapp/market/market.go, where MarketOrderData.ReferralPercentage is read from the listing while asset.Royalties.MarketPercentage is read live at purchase time. An asset owner can create a valid listing, then invoke AssetTrigger UpdateRoyalties to force the combined referral and royalty percentages to exceed the bid. The executeBuyMarket function pays referral and royalty amounts unconditionally, while computeMarketOwnerAmount silently skips a nonpositive seller remainder. This mismatch allows MarketBuy, BuyItNow, or auction Claim settlement to credit more KLV or sale currency than the buyer paid.

Critical Impact
An authenticated attacker can mint unbacked currency during marketplace settlement, corrupting token supply integrity across the Klever blockchain.

Affected Products

Klever-Go blockchain node implementation prior to v1.7.19
core/kapp/market/market.go marketplace settlement module
Klever chain deployments running vulnerable Klever-Go builds

Discovery Timeline

2026-08-28 - CVE-2026-54754 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-54754

Vulnerability Analysis

The vulnerability is a business logic flaw combined with an integer underflow condition classified under [CWE-191]. Klever-Go's marketplace settlement path reads two related economic parameters from different sources at different times. ReferralPercentage is captured when the listing is created, while MarketPercentage inside the asset's royalty configuration is fetched live during settlement. The asset owner controls the royalty configuration through AssetTrigger UpdateRoyalties.

An attacker who is also the asset owner can list an asset, then raise the royalty percentage so that referral plus royalty exceeds 100% of the buyer's bid. During settlement, executeBuyMarket pays both fees unconditionally from the buyer's payment pool. computeMarketOwnerAmount then computes the seller remainder. Because the remainder would be negative, the function silently skips crediting it rather than failing the transaction.

The net result is that the chain credits more KLV or sale currency to referral and royalty recipients than the buyer actually paid. The difference is created out of nothing, breaking conservation of supply.

Root Cause

The root cause is a time-of-check to time-of-use inconsistency in economic parameter handling. Listing-time and settlement-time reads of related percentages are not bound together, and the settlement path does not enforce the invariant referral + royalty + seller >= 0. When the arithmetic would produce a negative seller share, the code takes a silent skip branch instead of aborting the settlement.

Attack Vector

The attack requires low privileges: an account that owns a tradable asset. The attacker lists the asset, submits a self-referential or accomplice-controlled MarketBuy, BuyItNow, or auction Claim, and between listing and settlement calls AssetTrigger UpdateRoyalties to inflate the royalty percentage. Referral and royalty payouts are executed at the inflated rate, minting unbacked value to accounts under attacker control.

// Security patch: consensus-level freeze list of accounts implicated in the
// on-chain exploit trace, gated by the FixMarketBuyOverflow fork flag.
var frozenAccounts = map[string]struct{}{
    // klv12n4z3ef86sfk2z97j4fhfta9f2xztsv6frr8faqj7l8q9kc0fcdsfjfqez (root / minter)
    "54ea28e527d4136508be955374afa54a8c25c19a48c674f412f7ce02db0f4e1b": {},
    // klv1fzemma2s9d35l0hm38wt88srdyyqweufljqtps9jqkv32due3yqswqlfae
    "48b3bdf5502b634fbefb89dcb39e036908076789fc80b0c0b205991537998901": {},
    // klv1qfhu856w9gu8k9skay5sgquvl95erjygkmemycq07xspykqzm6vsqpty2m
    "026fc3d34e2a387b1616e92904038cf96991c888b6f3b2600ff1a0125802de99": {},
    // klv1wuug6007dnvgard8yvj5cydt70vuejm0kaasqrjs8r7rl7ftjexsglalf6 (25.6M, idle)
    "77388d3dfe6cd88e8da723254c11abf3d9cccb6fb77b000e5038fc3ff92b964d": {},
    // klv1hd58mwaz8cvyflkxwj3jewyqnuxnyp6sd3flc0tr0eqdc4ns343skngdjq (~125M KLV)
    "bb687dbba23e1844fec674a32cb8809f0d3207506c53fc3d637e40dc56708d63": {},
    // klv1qh5swknt7z4zr9e73ax87vflpvv7u4z9cce4wsa5uccsjffq4tpquv67ej
    "05e9075a6bf0aa21973e8f4c7f313f0b19ee5445c6335743b4e631092520aac2": {},
}

Source: GitHub Commit 8bcc600

Detection Methods for CVE-2026-54754

Indicators of Compromise

Transactions from the frozen account list published in the Klever-Go patch, including klv12n4z3ef86sfk2z97j4fhfta9f2xztsv6frr8faqj7l8q9kc0fcdsfjfqez and related hops
AssetTrigger UpdateRoyalties transactions that raise MarketPercentage shortly before a MarketBuy, BuyItNow, or auction Claim on the same asset
Marketplace settlements where the sum of referral and royalty transfers exceeds the buyer's payment amount

Detection Strategies

Replay marketplace settlement blocks and reconcile buyer debit against the sum of referral, royalty, and seller credits; any positive imbalance indicates exploitation
Alert on UpdateRoyalties transactions issued between a listing and its matching buy or claim by the same signing account
Compare on-chain total supply per KDA against expected mint and burn events to identify unbacked issuance

Monitoring Recommendations

Monitor node logs for skipped seller remainder branches in computeMarketOwnerAmount prior to upgrading to v1.7.19
Watch for large transfers originating from the six accounts identified in common/frozenAccounts.go
Track royalty configuration changes at the KDA level and correlate with active marketplace listings

How to Mitigate CVE-2026-54754

Immediate Actions Required

Upgrade all Klever-Go nodes to v1.7.19 or later, which enforces the FixMarketBuyOverflow fork flag and freezes attacker-controlled accounts
Coordinate a synchronized activation epoch across validators so the consensus freeze applies uniformly and does not diverge from chain history
Audit historical marketplace settlements to quantify any unbacked issuance and plan supply correction in a subsequent fork

Patch Information

The fix is available in GitHub Release v1.7.19. The patch introduces ErrAccountFrozen, a canonical frozenAccounts map in common/frozenAccounts.go, and the FixMarketBuyOverflow fork flag enforced in txProcessor.ProcessTransaction and the proposer build path. The freeze immobilizes outgoing transactions from implicated accounts; supply correction is deferred to a later fork. Full technical detail is documented in the GitHub Security Advisory GHSA-p7gw-2pcp-5pf8.

Workarounds

Set the FixMarketBuyOverflow activation epoch to a future value after all validators have deployed v1.7.19; never activate from genesis or a past epoch to avoid re-sync divergence
If upgrade cannot be immediate, disable marketplace transaction types at the node policy layer to block MarketBuy, BuyItNow, and auction Claim settlement
Restrict AssetTrigger UpdateRoyalties at the application gateway until all nodes run the patched release

bash

# Upgrade Klever-Go node to the patched release
git clone https://github.com/klever-io/klever-go.git
cd klever-go
git checkout v1.7.19
make build

# Verify the FixMarketBuyOverflow fork is configured with a future activation epoch
grep -A2 FixMarketBuyOverflow config/enableEpochs.toml

# Restart the node service after validator coordination
systemctl restart klever-node