Executive brief
Klever-Go is the software implementation of the Klever blockchain protocol. A vulnerability in its virtual machine (KVM) allows smart contracts to bypass "read-only" restrictions, which are intended to prevent a contract from making permanent changes to the blockchain. In practice, an attacker could use a read-only call to unexpectedly delete or upgrade a smart contract they own, breaking the security isolation between different blockchain operations and potentially leading to unauthorized state changes.
Technical details
A protection mechanism failure (CWE-693) exists in Klever-Go's KVM implementation prior to version 1.7.17. While the `ExecuteReadOnlyWithTypedArguments` hook correctly sets the runtime state to read-only, the host-core paths for contract deletion and upgrading fail to check this `runtime.ReadOnly()` flag. An attacker can exploit this by reaching a contract through a read-only execution context and then calling the production delete or upgrade hooks. This allows the contract to append addresses to `vmOutput.DeletedAccounts`, which the smart contract processor subsequently processes as permanent state changes. The vulnerability is fixed in v1.7.17 by enforcing the read-only invariant within the delete and upgrade dispatch paths.
Affected products
- Klever-io Klever-Go < 1.7.17
Timeline
- 2026-05-05: other: Internal fix commit for read-only invariant enforcement
- 2026-05-19: advisory: GitHub Security Advisory GHSA-jc6w-wmfc-fh33 published
- 2026-07-21: disclosed: CVE-2026-46403 published to NVD