Klever-Go, the Go implementation of the Klever blockchain protocol, improperly validates BLSPublicKey inputs in core/kapp/validators/validators.go prior to version 1.7.20. Specifically, the Register function and runtime validator update path accept keys without verifying curve membership, prime-order subgroup membership, or nonzero values. When a validator with such a malformed key is selected into a consensus group, the MultiSigner.Reset and signature verification processes fail to deserialize the group key, causing cancellation of the slot. This results in repeated missed consensus rounds, throughput degradation, and can cause the network to halt entirely if the consensus group equals the eligible validator set. Genesis validation is unaffected as it performs proper public key validation. The vulnerability is resolved in version 1.7.20.

The vulnerability can cause significant disruption to the Klever blockchain network by allowing malformed validator keys to cause signature verification failures. This leads to repeated missed consensus rounds and throughput degradation, and in worst cases, a complete network halt if the consensus group matches the eligible validator set. This impacts network availability and reliability but does not directly indicate compromise or data loss.

Upgrade Klever-Go to version 1.7.20 or later, where proper validation of BLSPublicKey inputs is enforced, preventing malformed keys from disrupting consensus. No other mitigations are indicated or required as the fix addresses the root cause.