{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/klever/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["klever-go"],"_cs_severities":["medium"],"_cs_tags":["integer-overflow","blockchain","financial-integrity"],"_cs_type":"advisory","_cs_vendors":["Klever"],"content_html":"\u003cp\u003eThe Klever blockchain node (klever-go) contains a critical integer overflow vulnerability in its split-royalty validation logic. The system decodes per-entry royalty percentages as \u003ccode\u003euint32\u003c/code\u003e values without individual upper bounds and aggregates them into a \u003ccode\u003euint32\u003c/code\u003e accumulator. By providing two split royalty entries that sum to a value exceeding 2^32, the accumulator wraps around to zero, successfully passing the 100% (10000) validation check.\u003c/p\u003e\n\u003cp\u003eDuring royalty payout, the system calculates payments using these massive overflowed values, crediting recipients with KLV far exceeding the original royalty pool. The negative remainder is silently discarded rather than returning an error, allowing the attacker to mint KLV or other assets out of thin air. This vulnerability is not gated by existing guards such as \u003ccode\u003eFixMarketBuyOverflow\u003c/code\u003e and remains exploitable on current mainnet deployments. Because the minted tokens are credited directly via balance modification rather than tracked mint events, the inflation remains invisible in official supply dashboards, posing a significant risk to the economic integrity of the ecosystem.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious KDA asset creation transaction using the \u003ccode\u003ekloperator\u003c/code\u003e tool.\u003c/li\u003e\n\u003cli\u003eThe transaction includes two split-royalty recipients, each assigned a percentage value of 21474836.48.\u003c/li\u003e\n\u003cli\u003eThe node processes these as raw \u003ccode\u003euint32\u003c/code\u003e values (\u003ccode\u003e2147483648\u003c/code\u003e), causing the sum to wrap around to \u003ccode\u003e0\u003c/code\u003e in the \u003ccode\u003euint32\u003c/code\u003e accumulator.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eCheckValid100Params\u003c/code\u003e function incorrectly validates the wrapped sum of \u003ccode\u003e0\u003c/code\u003e as permissible.\u003c/li\u003e\n\u003cli\u003eThe attacker initiates a standard asset transfer or market buy, triggering the royalty payout logic.\u003c/li\u003e\n\u003cli\u003eThe payout logic retrieves the overflowed \u003ccode\u003e2147483648\u003c/code\u003e percentage, calculating a massive credit for the recipient.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eAddToBalance\u003c/code\u003e function executes, crediting the recipient's wallet with inflated KLV or asset balances.\u003c/li\u003e\n\u003cli\u003eThe system silently ignores the resulting negative remainder, finalizing the unauthorized mint.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unbounded inflation of KLV and other assets. Because the inflation is handled via direct balance updates rather than tracked minting processes, the supply metrics appear accurate while the token value is eroded. This can lead to a total loss of economic integrity, affecting all holders within the Klever ecosystem. Any user with sufficient funds for transaction fees can exploit this without requiring administrative privileges.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImplement per-entry bounds checking in \u003ccode\u003edecodeSplitInfo\u003c/code\u003e within \u003ccode\u003ecore/kapp/builtInFunctions/utils.go\u003c/code\u003e to reject any individual percentage exceeding \u003ccode\u003eHundredPercent\u003c/code\u003e (10000).\u003c/li\u003e\n\u003cli\u003eModify the validation logic in \u003ccode\u003ecore/kapp/kda/create.go\u003c/code\u003e and \u003ccode\u003ecore/kapp/kda/trigger.go\u003c/code\u003e to use \u003ccode\u003euint64\u003c/code\u003e accumulators to prevent integer wrapping during the summation of royalty percentages.\u003c/li\u003e\n\u003cli\u003eEnforce these changes via a new activation-epoch fork flag to ensure historical blocks remain consistent while preventing future exploitation.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-28T21:13:51Z","date_published":"2026-08-28T21:13:51Z","id":"https://feed.craftedsignal.io/briefs/2026-08-klever-integer-overflow/","summary":"An integer overflow vulnerability in the Klever node (klever-go) allows attackers to mint arbitrary amounts of KLV and other assets by bypassing split-royalty validation checks.","title":"Integer Overflow in Klever Split-Royalty Validation Enables Unbounded Token Minting","url":"https://feed.craftedsignal.io/briefs/2026-08-klever-integer-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Klever","version":"https://jsonfeed.org/version/1.1"}