CVE-2026-54754: CWE-191: Integer Underflow (Wrap or Wraparound) in klever-io klever-go

In klever-go versions before 1.7.19, the marketplace settlement code reads referral and royalty percentages separately and allows an asset owner to manipulate these values so their sum exceeds the bid amount. The executeBuyMarket function pays referral and royalty amounts unconditionally, while computeMarketOwnerAmount skips nonpositive seller remainders silently. This discrepancy enables MarketBuy, BuyItNow, or auction Claim settlement to credit more KLV or sale currency than was actually paid by the buyer, effectively creating unbacked tokens and compromising token supply integrity. The vulnerability is classified as an integer underflow (CWE-191) and related to improper validation (CWE-367, CWE-682).

Exploitation of this vulnerability can result in the creation of unbacked currency within the Klever blockchain ecosystem, undermining the integrity of the token supply. This can lead to inflation of the currency and potential financial loss or disruption of the marketplace. The CVSS score of 9.6 indicates a critical severity with high impact on integrity and availability, requiring low privileges but no user interaction.

This vulnerability is fixed in klever-go version 1.7.19. Users and operators should upgrade to version 1.7.19 or later to remediate this issue. No other mitigation or workaround is indicated. Patch status is not explicitly stated beyond the fix in 1.7.19, so users should verify with the vendor advisory for the latest remediation guidance.