Klever Io
Monthly
Integer overflow in Klever-Go's semi-fungible token (SFT) add-quantity path prior to version 1.7.19 allows a mint-role holder to bypass a finite per-nonce MaxSupply constraint, minting approximately 9.2×10^18 tokens in a single transaction. The SFTAddCirculation function in core/kapp/systemAccount/systemAcount.go increments Circulation before checking the cap, enabling an int64 wraparound that makes the MaxSupply comparison permanently false. A proof-of-concept unit test is included in GHSA-mrpp-v6pg-p54x confirming the bypass; no CISA KEV listing is present at time of analysis.
Unbounded goroutine exhaustion in Klever-Go versions 1.7.14-1.7.17 allows any connected libp2p peer to remotely degrade or deny service to a Klever blockchain node by flooding it with well-formed direct messages. The root defect is architectural: `directMessageHandler` in `network/p2p/libp2p/netMessenger.go` spawns an unrestricted goroutine per incoming message before the processor-level antiflood layer can reject it, meaning admission control is structurally bypassed at ingress. No public exploit code has been identified at time of analysis, though the GHSA advisory provides a precise code walkthrough that substantially lowers exploitation complexity. The fix is available in v1.7.18.
Unauthenticated remote crash in Klever-Go versions 1.7.14-1.7.17 allows any network peer to terminate a node process by gossiping a 3-byte protobuf Transaction with the RawData sub-message omitted, triggering a nil-pointer dereference in the synchronous P2P validation callback with no panic recovery. No account, stake, validator key, or funds are required - the attacker only needs network reachability to the libp2p gossip port. Repeated delivery targeting enough BLS validators can halt block production entirely, constituting a chain-halt attack against the Klever network. No public exploit code or CISA KEV listing was identified, but the trivial payload and zero-prerequisite nature of exploitation make this a high-urgency upgrade target.
Consensus quorum bypass in Klever-Go prior to v1.7.20 allows a low-privileged block producer to satisfy the two-thirds validator signature threshold using phantom padding bits in the PubKeysBitmap rather than genuine validator signatures. Because the BLS aggregate-signature check ignores bits beyond the consensus group size while the quorum counter does not, a crafted block header with set padding bits appears validly signed without a real supermajority, undermining blockchain finality and consensus safety. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 1.7.20.
Integer overflow in Klever-Go's semi-fungible token (SFT) add-quantity path prior to version 1.7.19 allows a mint-role holder to bypass a finite per-nonce MaxSupply constraint, minting approximately 9.2×10^18 tokens in a single transaction. The SFTAddCirculation function in core/kapp/systemAccount/systemAcount.go increments Circulation before checking the cap, enabling an int64 wraparound that makes the MaxSupply comparison permanently false. A proof-of-concept unit test is included in GHSA-mrpp-v6pg-p54x confirming the bypass; no CISA KEV listing is present at time of analysis.
Unbounded goroutine exhaustion in Klever-Go versions 1.7.14-1.7.17 allows any connected libp2p peer to remotely degrade or deny service to a Klever blockchain node by flooding it with well-formed direct messages. The root defect is architectural: `directMessageHandler` in `network/p2p/libp2p/netMessenger.go` spawns an unrestricted goroutine per incoming message before the processor-level antiflood layer can reject it, meaning admission control is structurally bypassed at ingress. No public exploit code has been identified at time of analysis, though the GHSA advisory provides a precise code walkthrough that substantially lowers exploitation complexity. The fix is available in v1.7.18.
Unauthenticated remote crash in Klever-Go versions 1.7.14-1.7.17 allows any network peer to terminate a node process by gossiping a 3-byte protobuf Transaction with the RawData sub-message omitted, triggering a nil-pointer dereference in the synchronous P2P validation callback with no panic recovery. No account, stake, validator key, or funds are required - the attacker only needs network reachability to the libp2p gossip port. Repeated delivery targeting enough BLS validators can halt block production entirely, constituting a chain-halt attack against the Klever network. No public exploit code or CISA KEV listing was identified, but the trivial payload and zero-prerequisite nature of exploitation make this a high-urgency upgrade target.
Consensus quorum bypass in Klever-Go prior to v1.7.20 allows a low-privileged block producer to satisfy the two-thirds validator signature threshold using phantom padding bits in the PubKeysBitmap rather than genuine validator signatures. Because the BLS aggregate-signature check ignores bits beyond the consensus group size while the quorum counter does not, a crafted block header with set padding bits appears validly signed without a real supermajority, undermining blockchain finality and consensus safety. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 1.7.20.