Klever-Go, the Go implementation of the Klever blockchain protocol, is vulnerable to a nil-pointer dereference (CWE-476) in versions 1.7.14 through 1.7.17. The vulnerability arises when a protobuf Transaction message omits the embedded RawData sub-message, causing RawData to decode as nil. The txVersionChecker.CheckTxVersion function dereferences tx.RawData.Version without a nil check inside the libp2p pubsub topic-validator callback. Because no recover() is installed in the callback or underlying validation layers, the panic crashes the entire node process. An attacker can exploit this by sending a crafted 3-byte protobuf message without requiring validator keys, stake, funds, or on-chain accounts. Delivering this payload to enough BLS validators can halt block production, resulting in a chain halt. The vulnerability has been fixed in version 1.7.18.

Exploitation of this vulnerability causes a denial of service by crashing the Klever-Go node process. This can halt block production on the Klever blockchain network, disrupting network consensus and availability. The attack requires no privileges or on-chain resources, making it easy to execute. There is no impact on confidentiality or integrity, but the availability impact is high.

A fix is available in Klever-Go version 1.7.18. Users and operators should upgrade to version 1.7.18 or later to remediate this vulnerability. Until upgraded, nodes remain vulnerable to denial-of-service attacks via malformed protobuf transactions. No other mitigations are documented.