External risk intelligence

Klever-Go Royalty Logic Flaw Allows Unbacked Asset Creation.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-54755

The vulnerability involves royalty logic triggered by asset transfers, marketplace purchases, and ITOs. While these are network-reachable protocol functions, they require interaction with the blockchain's smart contract execution layer rather than direct exploitation of a simple, standalone network API endpoint. Access requires authenticated participation in the protocol's state transitions.

Integer Overflow

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Klever blockchain protocol's Go implementation could allow malicious actors to create unbacked assets through asset transfers, marketplace purchases, or ITOs by manipulating royalty payment calculations. This issue, present before version 1.7.19, involves integer overflow vulnerabilities that bypass validation checks, potentially impacting the integrity of the digital assets and the platform's economy.

Issue: Blockchain protocol allows unbacked asset creation via royalty manipulation.
Why remember: Affects core asset transfer and marketplace functions.
Executive takeaway: Confirm exposure and understand protocol integrity.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to the Klever blockchain protocol could exploit a flaw in how royalty percentages are processed. By submitting specially crafted values for split royalties, the attacker can bypass validation checks and cause the system to generate unbacked assets during ordinary transactions like asset transfers, marketplace purchases, or Initial Token Offerings (ITOs).

Requires authenticated protocol participation.
Bypassed validation on royalty split values.
Can mint unbacked digital assets.

Live Threat

Current exploitation, exposure, and threat context

The Klever blockchain protocol could allow the creation of unbacked assets through crafted royalty values during ordinary asset transfers, marketplace purchases, or ITO purchases. This occurs when oversized split royalty amounts are processed, leading to an invalid sum that bypasses validation checks.

Unbacked KLV or other assets.
Through asset transfers, marketplace, or ITOs.
Inflation of blockchain assets.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for the Klever blockchain protocol and its associated applications should address this vulnerability. The first practical step is to identify all instances of the affected Klever-Go implementation, confirm their reachability and criticality, and then coordinate remediation with the accountable product or platform owners.

Platform or application owners should own the issue.
Verify all deployment instances and their exposure.
Plan controlled updates or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Klever-Go?

Klever-Go is the official implementation of the Klever blockchain protocol written in the Go programming language. It manages core network operations, including processing transactions, marketplace activities, and Initial Token Offerings (ITOs). Essentially, it acts as the engine that maintains the blockchain's state and enforces rules for how assets and royalties move within the ecosystem.

What is the vulnerability in CVE-2026-54755?

This vulnerability is an Integer Overflow (CWE-190). When processing split-royalty fields, the code uses a 32-bit accumulator to sum values. By providing specific, oversized royalty percentages, these numbers wrap around to zero during calculation. This math trick causes the system to incorrectly bypass validation checks that should have blocked the transaction, leading to the unauthorized creation of digital assets.

How can an attacker trigger this bug?

An attacker triggers the flaw by submitting crafted royalty values during routine protocol activities like asset transfers or marketplace purchases. The bug specifically relies on creating an integer overflow; it is not triggered by standard, valid royalty percentages that sum correctly within the expected range. The system only fails when the input is intentionally manipulated to force the mathematical wrap-around.

Is my Klever-Go deployment at risk?

According to Halo Surface Signal, risk is possible but requires authenticated participation. Because this flaw exists within the protocol's smart contract execution layer, an attacker cannot simply hit a network endpoint to exploit it. You should assess your risk based on whether your instance actively processes asset transfers, marketplace transactions, or ITOs where users can submit these royalty values.

What is the first step to fix this?

The most important first step is to verify which versions of Klever-Go are currently running in your environment. If you are using any version prior to 1.7.19, you are vulnerable. Coordinate with your platform owners to plan an update to version 1.7.19 or later, which contains the necessary logic changes to correctly handle and validate royalty calculations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.