CVE-2026-55763

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55763
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55763.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55763
Aliases
Published
2026-08-28T20:26:43.720Z
Modified
2026-08-30T03:46:51.857715830Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits
Details

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay <= 0 early return. computeSplitRoyalties rejects only when splitToPay > royaltiesToPay, so a valid PercentTransferPercentage = 10000 split consumes exactly 100 percent of the royalty pool, sets royaltiesToPay to zero, and returns before the source account is debited. The split recipient receives the full royaltyAmount while the sender pays nothing and the supply counter is not updated, allowing unbounded off-the-books inflation of the transferred KDA. A KDA owner must configure a TransferPercentage royalty with a 100 percent split, after which any holder's transfer of the asset triggers the mint; the sibling processFixedRoyaltiesTransfer path is not affected because it debits the source before distribution. This issue is fixed in version 1.7.19.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55763.json",
    "cwe_ids": [
        "CWE-841"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/klever-io/klever-go

Affected ranges

Type
GIT
Repo
https://github.com/klever-io/klever-go
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8bcc600b0ac88070740c63c7ce1c8a968dd85251
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.7.19"
        }
    ]
}

Affected versions

v1.*
v1.7.14
v1.7.15
v1.7.16
v1.7.17
v1.7.18

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55763.json"