Klever-Go CVE-2026-55764

Exploitation requires the attacker to hold the mint role for the target SFT nonce - either as the asset owner or as an address explicitly granted the mint role by the owner. The target nonce must have a finite MaxSupply configured (MaxSupply != 0); nonces with MaxSupply set to 0 (unlimited) are not subject to the bypass because the cap check is already unconditionally skipped. Only the SFT add-quantity path (processSemiFungibleAddQuantity) is vulnerable; the fungible token mint path contains a post-increment MintedValue <= 0 guard and is not affected. The attacker must supply a raw Amount value sufficient to cause int64 wraparound, i.e., at or near math.MaxInt64. No user interaction is required beyond submitting a standard blockchain transaction. Authentication requirements beyond mint-role possession are not confirmed from the provided CVSS data, as the stated PR:N vector conflicts with the description's role requirement.

The provided CVSS 4.0 vector (PR:N) conflicts directly with the vulnerability description, which requires an active mint-role holder - an explicitly granted on-chain privilege. This discrepancy is significant: PR:N implies any unauthenticated network party can exploit the flaw, whereas the description and GHSA advisory are clear that only addresses holding the mint role for the target nonce can submit the malicious transaction. The CVSS 4.0 metric assignment of VA:H (availability) while omitting VI (integrity) also appears inconsistent with the primary observable impact, which is unauthorized minting of approximately MaxInt64 tokens and permanent corruption of the on-chain Circulation counter - both integrity violations. No EPSS data is available in the provided intelligence. A working proof-of-concept unit test is publicly available in the GHSA advisory, lowering the exploitation bar for any mint-role holder. The product is a niche blockchain implementation with a limited enterprise footprint, but for any operator running Klever-based infrastructure, this vulnerability directly undermines the economic invariant of finite token supply and should be treated as a high-priority upgrade. The consensus-level activation flag (FixMarketBuyOverflow) required by the fix means remediation depends on coordinated network upgrade, which adds operational complexity beyond a simple binary patch.

An address holding the mint role for an SFT nonce with MaxSupply set to 1000 submits a processSemiFungibleAddQuantity transaction with Amount equal to math.MaxInt64 (9223372036854775807). The unguarded addition wraps Circulation to approximately -9223372036854775804, causing the MaxSupply comparison to evaluate false; the function returns nil and credits ~9.2×10^18 tokens to the attacker. A working proof-of-concept unit test (TestExploit_SFTCirculationOverflowBypassesCap) is published in GHSA-mrpp-v6pg-p54x, confirming the complete bypass in a single transaction.