CVE-2026-54755: CWE-190: Integer Overflow or Wraparound in klever-io klever-go

The vulnerability arises from integer overflow or wraparound in the handling of split-royalty fields decoded in core/kapp/builtInFunctions/utils.go. Values greater than core.HundredPercent can be summed in uint32 accumulators in core/kapp/kda/create.go and core/kapp/kda/trigger.go, where crafted inputs such as two 0x80000000 entries cause the sum to wrap to zero, passing the CheckValid100Params validation incorrectly. Subsequently, royalty payout paths in core/kapp/accounts/accounts.go, core/kapp/market/market.go, and core/kapp/ito/ito.go credit each oversized split amount and discard a negative remainder silently. This flaw enables creation of unbacked KLV or other assets, violating asset integrity. The vulnerability is resolved in klever-go version 1.7.19.

Exploitation allows attackers with limited privileges to craft split-royalty values that bypass validation and cause creation of unbacked assets, potentially leading to unauthorized asset inflation and financial loss within the Klever blockchain ecosystem. The CVSS score of 9.6 reflects critical impact with high integrity and availability consequences but no confidentiality impact.

A fix is available in klever-go version 1.7.19. Users and administrators should upgrade to version 1.7.19 or later to remediate this vulnerability. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in 1.7.19. No additional mitigations are indicated.