Klever-Go's percentage‑transfer royalty function contains a logic error that allows a 100 % split to skip debiting the source account after royalties are exhausted. The function computeSplitRoyalties permits a split of exactly the entire royalty pool; the subsequent early return occurs before SubFromBalance is invoked on the source, leaving the sender's balance unchanged while the recipient receives the full royalty amount. The global supply counter likewise is not updated, creating a mechanism for unbounded off‑the‑books minting of KDA.

All installations of Klever-Go released before version 1.7.19 are affected. The vulnerability is specific to the Klever‑IO blockchain implementation, and impacts any KDA holder who has configured a TransferPercentage royalty with a 100 % split. The fix is distributed in release 1.7.19, which corrects the transfer logic.

The vulnerability scores a CVSS of 8.7, indicating high severity. EPSS is not available, but the flaw can be exercised by any actor who initiates a token transfer that triggers a 100 % royalty split, a situation that many owners may have configured. The bug is listed as non‑exploited in the CISA KEV catalog; however, because it enables the minting of new tokens without source debits, the potential impact on token economics is significant.