Listen to this Post
The vulnerability resides in the semi-fungible token (SFT) supply management logic of the Klever blockchain protocol’s Go implementation, klever-go. Specifically, it affects the `SFTAddCirculation` function located in core/kapp/systemAccount/systemAcount.go. This function is responsible for updating the circulating supply (Circulation) of a specific SFT nonce when new tokens are minted.
The core issue is an unsafe integer addition operation. The function performs `meta.Circulation += amount` without any prior check for signed 64-bit integer overflow. Following this addition, it checks if the new `Circulation` exceeds the per-nonce MaxSupply. If the `amount` supplied is large enough, specifically near `math.MaxInt64` (9,223,372,036,854,775,807), the addition overflows and wraps the `Circulation` value to a negative number.
Because the subsequent cap check (if meta.Circulation > meta.MaxSupply) compares a negative number against a positive MaxSupply, it evaluates to false. This bypasses the supply cap, and the function returns without an error (nil). Consequently, a mint-role holder can mint an enormous number of tokens, far exceeding the declared MaxSupply, in a single transaction. The fungible token minting path is not vulnerable, as it includes a post-increment guard (MintedValue <= 0) that correctly detects the overflow.
The vulnerability has been assigned a CVSS v4.0 base score of 8.7 (High) and is tracked as CWE-190: Integer Overflow or Wraparound. The fix, implemented in version 1.7.19, reorders operations to check `MaxSupply` before performing the addition and utilizes a consensus activation flag (FixMarketBuyOverflow).
DailyCVE Form:
Platform: Klever-Go
Version: < 1.7.19
Vulnerability: Integer Overflow
Severity: High (8.7)
date: 2026-08-28
Prediction: 2026-08-29
What Undercode Say:
Analytics:
- Vulnerability allows bypassing SFT supply caps
- Exploitable only by mint-role holders
- Fungible token path is not vulnerable
- Fixed in version 1.7.19
Bash commands and codes:
Check klever-go version go list -m github.com/klever-io/klever-go Upgrade to patched version go get github.com/klever-io/[email protected]
Exploit: (Educational Purposes!)
// PoC demonstrating the overflow bypass const overflowAmount = int64(math.MaxInt64) // Calling SFTAddCirculation with MaxInt64 overflows Circulation // and bypasses the MaxSupply check. err := s.SFTAddCirculation(asset, nonce, overflowAmount) // err is nil, Circulation becomes negative
Protection:
- Upgrade to `klever-go` version 1.7.19 or later
- Enable consensus flag `FixMarketBuyOverflow`
– Temporarily disable SFT add-quantity operations if unable to upgrade - Monitor for sudden supply spikes
Impact:
- Mint-role holder can mint ~9.2e18 units of a capped SFT nonce
- On-chain `Circulation` counter becomes negative
- Misleads market data/indexers and corrupts token supply integrity
- Allows creation of unbacked digital assets
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
