CyberRota Analysis
AI-GeneratedThe vulnerability in Klever-Go allows mint-role holders to bypass the MaxSupply limit for semi-fungible tokens due to improper handling of signed integer overflow, potentially leading to the issuance of excessive tokens and corruption of the on-chain counter. This flaw impacts any implementation of the Klever blockchain protocol prior to version 1.7.19, making it critical for developers and organizations using this protocol to prioritize upgrading to the patched version to mitigate the risk of token inflation and integrity issues.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/systemAcount.go, SFTAddCirculation performed meta.Circulation += amount before evaluating whether Circulation exceeded MaxSupply, without checking for signed int64 overflow. A large positive raw Amount supplied through processSemiFungibleAddQuantity in core/kapp/kda/mint.go can wrap Circulation negative, causing the signed maximum-supply comparison to pass and crediting approximately MaxInt64 units while corrupting the on-chain counter. The fungible path is not affected because its MintedValue <= 0 guard detects the overflow. The correction uses the consensus activation flag FixMarketBuyOverflow. This issue is fixed in version 1.7.19.