The vulnerability in Klever-Go’s marketplace settlement logic allows an asset owner to inflate the amount of KLV or other sale currency that is credited to buyers. The code unconditionally pays referral and royalty percentages read from the listing while silently discarding a non‑positive seller remainder. An attacker can create a listing and then modify referral and royalty percentages so the combined percentage exceeds the bid amount. When the deal settles the system credits more KLV than the buyer paid, creating unbacked currency and breaking the integrity of the token supply. This flaw is a data‑type or an arithmetic overflow/underflow, related to unchecked arithmetic and improper input validation (CWE‑191, CWE‑367, CWE‑682).

The flaw exists in Klever-IO’s Klever-Go implementation of the Klever blockchain protocol, affecting any deployment using a version older than 1.7.19. The market settlement code in core/kapp/market/market.go is the vulnerable area. All releases prior to v1.7.19 are affected, as the patch is first supplied in v1.7.19.

The CVSS score of 9.6 indicates critical severity, and the vulnerability is listed in the KLEVER Go database but not yet on the CISA KEV catalog. With no EPSS available, the exploitation probability is uncertain, but the flaw requires an asset owner to manipulate referral and royalty percentages, which is locally possible via normal marketplace actions. Because the bug silently discounts the seller's share, the attacker has the potential to create unbacked KLV or foreign sale currency, directly compromising the trust model and monetary integrity of the network. The impact is wide scope, potentially affecting all market participants if leveraged.