An integer overflow flaw in the split-royalty validation of Klever-Go allows attackers to submit royalty fields larger than the defined maximum. Because the sum of these values is calculated in a 32-bit unsigned accumulator, the boundary overflow wraps the total to zero, bypassing the validity check. The bug is then exploited by crediting each oversized split amount and silently discarding any negative remainder, which enables the creation of unbacked KLV tokens or other assets during normal asset transfers, marketplace purchases, or ITO transactions.

The vulnerability affects all installations of the Klever-Go client before version 1.7.19. The product is the Go implementation of the Klever blockchain protocol, distributed under the name Klever-Go by Klever-IO. Any deployment that runs the pre-1.7.19 codebase is susceptible.

The flaw carries a CVSS score of 9.6, indicating critical severity, and the EPSS score is not available, but the lack of a KEV listing does not diminish its threat. Attackers who can formulate specific asset transfer or marketplace requests, which is possible for any network participant, can trigger the overflow and create arbitrary amounts of native KLV. The attack does not require privileged access beyond normal transaction capabilities, making exploitation likely for malicious actors who target the network.