CVE-2026-55763: CWE-841: Improper Enforcement of Behavioral Workflow in klever-io klever-go

The vulnerability arises from improper enforcement of behavioral workflow in klever-go's processPercentageRoyaltiesTransfer function. When a TransferPercentage royalty is configured with a 100% split, the function consumes the entire royalty pool and sets royaltiesToPay to zero, then returns early without debiting the source account. Consequently, the split recipient receives the full royalty amount while the sender pays nothing, and the supply counter is not updated, enabling unbounded inflation of the KDA token. The sibling processFixedRoyaltiesTransfer function is unaffected as it debits the source before distribution. This flaw is addressed in klever-go version 1.7.19.

An attacker or any KDA owner configuring a 100% TransferPercentage royalty can exploit this flaw to mint unlimited KDA tokens without debiting the sender's balance, causing inflation and undermining the token's economic integrity. This impacts the blockchain's trustworthiness and could lead to financial loss or destabilization of the token economy.

This vulnerability is fixed in klever-go version 1.7.19. Users and operators should upgrade to version 1.7.19 or later to remediate this issue. No other mitigation or temporary workaround is indicated. Patch status is not explicitly confirmed beyond the fix in 1.7.19; verify with vendor advisories for current guidance.