Read the docs
TI-2026-40252 Aliases CVE-2026-55763GHSA-v358-wf77-39xv

Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Priority HIGH 77CWE-841Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay <= 0 early return. computeSplitRoyalties rejects only when splitToPay > royaltiesToPay, so a valid PercentTransferPercentage = 10000 split consumes exactly 100 percent of the royalty pool, sets royaltiesToPay to zero, and returns before the source account is debited. The split recipient receives the full royaltyAmount while the sender pays nothing and the supply counter is not updated, allowing unbounded off-the-books inflation of the transferred KDA. A KDA owner must configure a TransferPercentage royalty with a 100 percent split, after which any holder's transfer of the asset triggers the mint; the sibling processFixedRoyaltiesTransfer path is not affected because it debits the source before distribution. This issue is fixed in version 1.7.19.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00507 43rd percentileScored 2026-11-07
Fix Fixed klever-go (klever-io): 1.7.19github.com/klever-io/klever-go (Go): 1.7.19-rc4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
klever-ioklever-gobefore 1.7.191.7.19Patch availableCNA
—github.com/klever-io/klever-go (Go)before 1.7.19-rc41.7.19-rc4Patch availableGHSA-v358-wf77-39xv
  • klever-go Vendorklever-io Affected before 1.7.19 Fixed in 1.7.19 Patch available CNA
  • github.com/klever-io/klever-go (Go) Vendor— Affected before 1.7.19-rc4 Fixed in 1.7.19-rc4 Patch available GHSA-v358-wf77-39xv

Remediation

  • Fix · CNA klever-go (klever-io) Fixed in 1.7.19
  • Fix · GHSA-v358-wf77-39xv github.com/klever-io/klever-go (Go) Fixed in 1.7.19-rc4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55763
  2. 2026-10-03 Alias added: GHSA-v358-wf77-39xv

References

Other 4

  • TI-2026-40253 Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply CVSS 4.0HIGH 8.7
  • TI-2026-58874 Klever-Go: /log controls global node logging CVSS 3.1HIGH 8.6
  • TI-2026-32588 Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload CVSS 3.1HIGH 8.6
  • TI-2026-39560 Integer underflow in klever-io klever-go CVSS 3.1CRITICAL 9.6
  • TI-2026-58875 Resource allocation without limits in klever-io klever-go CVSS 3.1HIGH 7.5
  • TI-2026-37979 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences