Prior to version 1.7.17, Klever‑Go exposed a read‑only execution API that temporarily sets a runtime flag. The delete and upgrade pathways within the contract framework do not reject operations when this flag is set, which means a contract invoked under read‑only execution can call the delete or upgrade functions of a contract it owns. The delete operation records the target address in a list that is later processed to delete accounts, effectively erasing the contract. Because the runtime flag is not enforced by the host‑core delete and upgrade logic, this flaw breaks the expected isolation between read‑only contract calls and state‑changing side effects. The vulnerability is a CWE‑693 data‑integrity issue that can be used to silently delete or replace contracts.

All releases prior to version 1.7.17 of the Klever‑Go implementation distributed by klever‑io are affected. A contract reached via read‑only execution can trigger the production delete hook for a target that it owns, leading to unintentionally deleted contracts. The issue was fixed in release 1.7.17 when delete and upgrade paths now reject execution when the runtime is marked read‑only.

The CVSS score of 6.3 denotes a moderate severity, yet the EPSS score is below 1 percent which indicates a low exploitation probability at present, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is a malicious or compromised smart contract that initiates read‑only calls targeting delete or upgrade functions, making it primarily an insider or supply‑chain risk. If exploited, an attacker could erase legitimate contracts or replace them with malicious code, resulting in loss of functionality and potential financial loss for users interacting with those contracts.