Executive brief
Klever-Go's marketplace is a native cryptocurrency exchange for trading NFTs. An attacker can trick victims into bidding on already-settled (claimed) orders by exploiting a missing validation in the Buy function. Victims lose their entire bid with no way to recover it or cancel—the attacker keeps both the NFT and siphons cryptocurrency from subsequent bidders.
Technical details
The marketplace Buy function lacks an IsClaimed guard present in Claim and CancelOrder. When a seller accepts a resting-bid auction early via Claim, the order is marked IsClaimed but EndTime is not reset and the order is not deleted, creating a "zombie" order that appears live but is already settled. An attacker can exploit this by creating a resting auction, accepting it early (keeping the NFT), then waiting for victims to bid on the zombie order. The Buy function has no IsClaimed check, so it accepts the victim's bid, debits the victim's balance, refunds the prior (attacker-controlled) bidder, and records the victim as CurrentBidder. The victim then cannot Claim (blocked by IsClaimed) or CancelOrder (blocked by IsClaimed), permanently losing their funds. The attack is permissionless and repeatable, enabling theft via fund destruction and Sybil bidding.
Affected products
- Klever Klever-Go prior to fix
Timeline
- 2026-09-23: disclosed
- 2026-09-23: advisory: GHSA-26r5-4mm2-px5c