Listen to this Post
The vulnerability resides in the settlement logic of the Klever blockchain’s marketplace module. When an order is settled, the buyer’s payment is split into three parts: referral fees, royalties, and the seller’s remainder. The referral and royalty amounts are paid out unconditionally, while the seller’s remainder is only disbursed if it is a positive value. If the combined percentage of referral and royalty fees exceeds 100% of the bid, the seller’s remainder becomes negative and is silently skipped, meaning no error is returned and no value is paid to the seller. However, the referral and royalty payments are still made in full, resulting in the marketplace paying out more than the buyer deposited. This creates an inflation vulnerability where the surplus value is effectively minted out of thin air.
The root cause is a Time-of-Check to Time-of-Use (TOCTOU) issue. The combined ceiling of royalty plus referral percentages is checked once at the time of listing. At this point, the referral percentage is snapshotted and stored in the order, but the royalty percentage is not; it is read live from the asset’s metadata during settlement. The asset owner can later mutate the royalty percentage via a standard `UpdateRoyalties` transaction, which only validates that the individual royalty value is within 0-100%, without re-evaluating the combined invariant against any existing open orders. Consequently, an attacker can list an asset with a safe combination (e.g., 100% referral, 0% royalty), then raise the royalty to 100% after the listing is active. When the order is bought, the settlement logic computes a referral amount (100% of bid) and a royalty amount (100% of bid), sums them to 200% of the bid, and pays out both in full. The seller’s remainder is negative and silently ignored, resulting in a net profit for the attacker of 100% of the bid value, which is new currency created by the contract.
DailyCVE Form:
Platform: Klever blockchain
Version: Pre-Fix Klever-Go
Vulnerability : Settlement value overflow
Severity: Critical
date: 2026-06-04
Prediction: Patch likely July 2026
What Undercode Say:
To simulate the vulnerability, you can run the dedicated regression test included in the codebase:
go test ./core/kapp/market/ -run TestMarketKApp_ExecuteBuyMarket_RoyaltyReferralInflation -v
Exploit: (Educational Purposes!)
An attacker with a funded account can execute the exploit in four transactions:
1. Create an NFT collection with `royalties.marketPercentage = 0` and a controlled royalty address.
2. Create a marketplace with `referralPercentage = 10000` (100%) and a controlled referral address.
3. List an NFT for sale on that marketplace. The listing passes the combined check (0% + 100% = 100%).
4. Raise the royalty on the asset to 100% via UpdateRoyalties.
5. Buy the listed NFT. The settlement will pay out 2x the bid amount to the attacker’s referral and royalty addresses, minting the difference.
Protection:
The immediate protection is the emergency guard which blocks known malicious senders and halts marketplace operations. The permanent fix is a protocol-level epoch-gated patch (FixMarketBuyOverflow) which adds a hard check in the settlement logic. If marketOwnerAmount < 0, the transaction is aborted with an `AmountInvalid` error before any payouts are executed. Further hardening includes snapshotting the royalty percentage at listing or re-evaluating the combined invariant at settlement.
Impact:
- Unbounded inflation of the native currency, allowing any attacker to mint unlimited tokens for the cost of transaction fees.
- The minted tokens are invisible to the tracked supply, only detectable via balance anomalies.
- This vulnerability was actively exploited on mainnet, with attackers minting millions of KLV and bridging ~$72K worth of assets to Ethereum before the emergency guard was deployed.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
