CVE-2026-55763: Klever-Go Privilege Escalation Vulnerability

CVE-2026-55763 Overview

CVE-2026-55763 is a business logic flaw in Klever-Go, the Go implementation of the Klever blockchain protocol. Versions prior to 1.7.19 mishandle percentage-based royalty transfers in processPercentageRoyaltiesTransfer inside core/kapp/accounts/accounts.go. When a Klever Digital Asset (KDA) owner configures a TransferPercentage royalty with a 100 percent split (PercentTransferPercentage = 10000), the function distributes the full royalty amount to the recipient but returns before debiting the sender or updating the supply counter. The result is unbounded off-the-books inflation of the affected KDA on every subsequent transfer by any holder. The issue is fixed in Klever-Go version 1.7.19.

Critical Impact
Any holder transferring a maliciously configured KDA can mint tokens without cost, inflating supply beyond accounting limits and undermining ledger integrity.

Affected Products

Klever-Go blockchain node prior to 1.7.19
Klever Digital Assets (KDA) configured with TransferPercentage royalties
Klever blockchain networks running vulnerable node versions

Discovery Timeline

2026-08-28 - CVE-2026-55763 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55763

Vulnerability Analysis

The defect resides in processPercentageRoyaltiesTransfer within core/kapp/accounts/accounts.go. The function computes per-recipient royalty splits, then calls SubFromBalance on the source account only after the split loop completes. Critically, the debit occurs after an early return that triggers when royaltiesToPay <= 0.

The helper computeSplitRoyalties rejects a split only when splitToPay > royaltiesToPay. A split equal to royaltiesToPay is accepted. When a recipient is configured with PercentTransferPercentage = 10000 (100 percent), that single recipient consumes the entire royalty pool. The counter royaltiesToPay reaches zero, the early-return branch executes, and SubFromBalance never runs against the sender.

The recipient still receives the full royaltyAmount, but no corresponding debit occurs and the KDA supply counter is not incremented. Each subsequent transfer of the asset repeats the mint. The sibling processFixedRoyaltiesTransfer path is unaffected because it debits the source before distributing.

Root Cause

The root cause is an improper enforcement of behavioral workflow, classified as [CWE-841] (Improper Enforcement of Behavioral Workflow). The debit step is placed after a conditional early return that a valid input configuration can reach, allowing the ledger update sequence to complete asymmetrically. The balance debit and the supply reconciliation are treated as post-loop tail operations rather than atomic prerequisites of the transfer.

Attack Vector

Exploitation requires two roles. First, a KDA owner configures the asset with a TransferPercentage royalty and sets a single split to PercentTransferPercentage = 10000. After that configuration, any holder transferring the KDA triggers the flaw. The recipient defined in the split receives the royalty amount while the sender is not debited and supply accounting is skipped. The attack requires no authentication of the transferring holder beyond normal transaction submission and executes over the network by broadcasting a standard transfer transaction.

// Security patch additions in common/errors.go (klever-io/klever-go)
// ErrInvalidValue signals that a nil value has been provided
var ErrInvalidValue = errors.New("invalid value provided")

// ErrAccountFrozen signals that a transaction was sent from a consensus-frozen account
var ErrAccountFrozen = errors.New("account is frozen")

// ErrNilSignalChan returns whenever a nil signal channel is provided
var ErrNilSignalChan = errors.New("nil signal channel")

Source: GitHub Commit 8bcc600

The patch also introduces a frozenAccounts list in common/frozenAccounts.go that immobilizes a set of attacker-controlled addresses tied to the on-chain mint trace, gated by the FixMarketBuyOverflow fork flag and enforced in txProcessor.ProcessTransaction.

Detection Methods for CVE-2026-55763

Indicators of Compromise

Transactions distributing KDA royalties to accounts listed in the upstream frozenAccounts map, including klv12n4z3ef86sfk2z97j4fhfta9f2xztsv6frr8faqj7l8q9kc0fcdsfjfqez (root minter) and klv1hd58mwaz8cvyflkxwj3jewyqnuxnyp6sd3flc0tr0eqdc4ns343skngdjq (collector hop, ~125M KLV).
KDA assets configured with a TransferPercentage royalty whose split entries contain PercentTransferPercentage = 10000.
Divergence between observed on-chain KDA balances and the asset's recorded supply counter.

Detection Strategies

Reconcile per-asset supply totals against the sum of holder balances after each block to detect off-the-books mints.
Scan the asset registry for KDAs whose royalty configuration contains a 100 percent split recipient.
Alert on transfers where the recipient balance increased without a matching sender debit in the same transaction receipt.

Monitoring Recommendations

Track node software versions across the validator fleet and flag any node running Klever-Go below 1.7.19.
Monitor block explorers and chain indexers for KDA mint anomalies and abnormal royalty payout volumes.
Log and review all KDA configuration changes that add or modify TransferPercentage royalty splits.

How to Mitigate CVE-2026-55763

Immediate Actions Required

Upgrade all Klever-Go nodes to version 1.7.19 or later, which reorders the debit step and rejects splits that consume the full royalty pool without balance reconciliation.
Audit existing KDAs for TransferPercentage royalty configurations containing 100 percent splits and freeze affected assets pending review.
Apply the FixMarketBuyOverflow fork flag configuration with a future activation epoch that follows the last outgoing transaction of frozen accounts and post-dates fleet rollout.

Patch Information

The fix is available in Klever-Go v1.7.19. The complete change set is described in GHSA-v358-wf77-39xv and implemented in commit 8bcc600.

Workarounds

Reject KDA configuration transactions that set any split's PercentTransferPercentage to 10000 at the application or indexer layer until nodes are upgraded.
Disable percentage-based royalty processing for high-value KDAs by removing TransferPercentage royalty entries from asset metadata.
Enforce validator consensus policies that refuse to propose or attest blocks containing transfers involving the published frozen account list.

bash

# Verify Klever-Go node version and upgrade path
klever-go version
# Expected output: v1.7.19 or later

# Fetch and check out the fixed release
git fetch --tags
git checkout v1.7.19
go build ./...