CVE-2026-55763

Deferred Deferred - Pending Action

Integer Overflow in Klever-Go Blockchain Protocol

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay <= 0 early return. computeSplitRoyalties rejects only when splitToPay > royaltiesToPay, so a valid PercentTransferPercentage = 10000 split consumes exactly 100 percent of the royalty pool, sets royaltiesToPay to zero, and returns before the source account is debited. The split recipient receives the full royaltyAmount while the sender pays nothing and the supply counter is not updated, allowing unbounded off-the-books inflation of the transferred KDA. A KDA owner must configure a TransferPercentage royalty with a 100 percent split, after which any holder's transfer of the asset triggers the mint; the sibling processFixedRoyaltiesTransfer path is not affected because it debits the source before distribution. This issue is fixed in version 1.7.19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-55763

Affected Vendors & Products

Vendor	Product	Version / Range
klever	klever-go	1.7.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-841	The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

Executive Summary

This vulnerability in Klever-Go blockchain protocol allows unbounded inflation of transferred KDA tokens. It occurs when a royalty split is set to 100% and a transfer is made. The processPercentageRoyaltiesTransfer function fails to debit the sender's account while still distributing the full royalty amount to the recipient, creating new tokens without updating the supply counter.

Detection Guidance

This vulnerability is specific to the Klever-Go blockchain implementation and requires checking the version of the software and verifying the configuration of TransferPercentage royalties. No direct network or system commands are provided in the context to detect this issue.

Impact Analysis

If you hold or transfer KDA tokens with a 100% royalty split configured, attackers can exploit this to create unlimited new tokens during transfers. This devalues your holdings and disrupts the token economy. The vulnerability requires a specific royalty configuration to be active.

Compliance Impact

This vulnerability allows unbounded inflation of transferred KDA tokens through off-the-books minting, which could violate financial integrity and accounting standards. It may impact compliance with regulations requiring accurate financial reporting and asset tracking, such as GDPR (data integrity) or HIPAA (audit controls), if the affected tokens are used in regulated contexts.

Mitigation Strategies

Upgrade Klever-Go to version 1.7.19 or later to address the vulnerability in processPercentageRoyaltiesTransfer that allows unbounded inflation of KDA tokens.

Hi! I’m here to help you understand CVE-2026-55763. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70