Executive brief
The Klever blockchain library's semi-fungible token (SFT) minting function fails to validate integer overflow when adding tokens to circulation. A mint-role holder can mint approximately 9.2 quintillion tokens in a single transaction, bypassing a declared supply cap and corrupting the on-chain circulation counter. This allows unauthorized token creation at massive scale with no corresponding debit.
Technical details
The vulnerability is an integer overflow in the SFTAddCirculation function (core/kapp/systemAccount/systemAcount.go:132-138). The code performs an unguarded addition `meta.Circulation += amount` where amount is a raw int64 parameter from the contract with no upstream bounds. When amount is large enough (e.g., MaxInt64), the addition overflows and wraps to a negative value. The subsequent cap check `if meta.Circulation > meta.MaxSupply && meta.MaxSupply != 0` evaluates to false because a negative number is not greater than MaxSupply, allowing the function to return nil and persist the corrupted circulation value. The fungible mint path is protected by a post-increment `MintedValue <= 0` guard that this code path lacks. Attack vector is network-based; requires mint-role holder authorization (asset owner or delegated role). A proof-of-concept unit test confirms the overflow and bypass, and live on-chain testing demonstrates minting MaxInt64 tokens past a declared cap of 1000 with result code Ok.
Affected products
- klever-io klever-go < 1.7.19
Timeline
- 2026-06-22: disclosed
- 2026-06-22: patched: Fixed in version 1.7.19
- 2026-08-28: other: CVE-2026-55764 published