CVE-2026-54755: Klever-Go Integer Overflow Privilege Escalation

CVE-2026-54755 Overview

CVE-2026-54755 is an integer overflow vulnerability [CWE-190] in Klever-Go, the Go implementation of the Klever blockchain protocol. Versions prior to 1.7.19 accept split-royalty entries whose individual values exceed core.HundredPercent. The validation routine CheckValid100Params sums these values in a uint32 accumulator, which wraps to zero when crafted entries such as two 0x80000000 values are supplied. Royalty payout paths then credit each oversized split and silently discard the negative remainder. An attacker can trigger this through ordinary asset transfers, marketplace purchases, or Initial Token Offering (ITO) purchases to create unbacked KLV or other assets on-chain.

Critical Impact
Authenticated network attackers can mint unbacked KLV and other blockchain assets, breaking supply integrity across the Klever ecosystem.

Affected Products

Klever-Go blockchain node software prior to version 1.7.19
core/kapp/builtInFunctions/utils.go split-royalty decoder
core/kapp/kda/create.go and core/kapp/kda/trigger.go validation paths

Discovery Timeline

2026-08-28 - CVE-2026-54755 published to the National Vulnerability Database (NVD)
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-54755

Vulnerability Analysis

The flaw is a classic integer overflow in blockchain accounting logic. Split-royalty fields decoded in core/kapp/builtInFunctions/utils.go are permitted to hold values greater than core.HundredPercent. When core/kapp/kda/create.go and core/kapp/kda/trigger.go add these entries into a 32-bit unsigned accumulator, values such as two 0x80000000 entries wrap the sum to zero. That zero passes CheckValid100Params, which is meant to enforce that royalty splits total 100 percent.

Downstream payout logic in core/kapp/accounts/accounts.go, core/kapp/market/market.go, and core/kapp/ito/ito.go then credits each oversized split at its face value. The routines subtract the aggregate from the source amount using signed arithmetic and discard the resulting negative remainder without failing the transaction. The net effect is that royalty recipients receive more asset units than the payer transferred, producing unbacked tokens.

Root Cause

The root cause is missing per-field bounds checking combined with a uint32 accumulator that permits modular wrap-around. Validation trusts that the sum reflects the true total, but modular arithmetic allows attacker-chosen entries to produce a valid-looking sum of zero while individual entries remain arbitrarily large.

Attack Vector

An authenticated account submits a Klever Digital Asset (KDA) definition or trigger that contains crafted split-royalty entries. The account then initiates a normal asset transfer, marketplace purchase, or ITO purchase referencing that asset. The chain executes the payout, credits each oversized split, and issues unbacked KLV or KDA tokens to attacker-controlled addresses.

// Security patch excerpt: common/frozenAccounts.go
// Adds a consensus-level freeze list for accounts implicated in the
// value-creation exploit, gated by the FixMarketBuyOverflow fork flag.
var frozenAccounts = map[string]struct{}{
    // klv12n4z3ef86sfk2z97j4fhfta9f2xztsv6frr8faqj7l8q9kc0fcdsfjfqez (root / minter)
    "54ea28e527d4136508be955374afa54a8c25c19a48c674f412f7ce02db0f4e1b": {},
    // klv1hd58mwaz8cvyflkxwj3jewyqnuxnyp6sd3flc0tr0eqdc4ns343skngdjq (collector hop, ~125M KLV)
    "bb687dbba23e1844fec674a32cb8809f0d3207506c53fc3d637e40dc56708d63": {},
    // klv1qh5swknt7z4zr9e73ax87vflpvv7u4z9cce4wsa5uccsjffq4tpquv67ej (NFT buy/sell operations account, attacker-controlled)
    "05e9075a6bf0aa21973e8f4c7f313f0b19ee5445c6335743b4e631092520aac2": {},
}

Source: GitHub Commit 8bcc600

Detection Methods for CVE-2026-54755

Indicators of Compromise

KDA create or trigger transactions containing split-royalty entries with individual values greater than core.HundredPercent (100000).
Royalty accumulator sums that mathematically wrap around uint32 boundaries, such as multiple 0x80000000 entries.
Unexplained increases in total supply for KLV or KDA assets following marketplace or ITO activity.
Outbound transfers from the frozen-account list published in the GHSA-cgc5-v3f2-8m2v advisory.

Detection Strategies

Reindex historical KDA definitions and flag any asset whose stored split entries individually exceed the 100 percent constant.
Cross-check per-transaction supply deltas against expected mint or burn events and alert on divergences.
Compare on-chain balances of implicated addresses against the canonical minter set enumerated in the patch commit.

Monitoring Recommendations

Ingest Klever-Go node logs into a centralized data lake and alert on transactions rejected by FixMarketBuyOverflow after fork activation.
Monitor node versions across validator infrastructure to confirm all peers run 1.7.19 or later.
Track large royalty payouts relative to transaction principal amounts as an anomaly signal.

How to Mitigate CVE-2026-54755

Immediate Actions Required

Upgrade all Klever-Go nodes and validators to version 1.7.19 as published in GitHub Release v1.7.19.
Activate the FixMarketBuyOverflow fork flag at a future epoch coordinated across the validator fleet, per the operator guidance in the patch commit.
Audit KDA assets created before the fix for split-royalty entries that exceed core.HundredPercent and quarantine any suspect assets.
Review the frozen-account list in the GitHub Security Advisory GHSA-cgc5-v3f2-8m2v and confirm operator configuration matches the canonical set.

Patch Information

The fix ships in Klever-Go 1.7.19. The GitHub Commit 8bcc600 introduces per-field validation, a consensus-gated freeze of implicated accounts, and the FixMarketBuyOverflow fork flag enforced in txProcessor.ProcessTransaction. Supply correction is not automatic; freezing only blocks outbound transactions from listed addresses.

Workarounds

Reject any incoming KDA create or trigger transactions containing split-royalty values above 100000 at the mempool layer until the upgrade completes.
Pause marketplace and ITO functionality on unpatched infrastructure to remove the exploitation paths described in the advisory.
Set the fork activation epoch strictly in the future so re-syncs and import-db reindexes do not replay historical transactions and diverge from chain history.

bash

# Verify node version before returning to production
klever-go version | grep -E "1\.7\.(19|[2-9][0-9])"

# Confirm fork flag is scheduled for a future epoch in operator config
grep -A1 FixMarketBuyOverflow /etc/klever/node-config.toml