The SFT add‑quantity method in Klever‑Go performs a signed 64‑bit addition to the circulating supply before it verifies that the new total does not exceed the per‑nonce MaxSupply. A mint‑role holder can submit a very large positive amount that causes the signed int64 addition to overflow, wrapping the result into a negative value. The following signed‑maximum‑supply comparison then incorrectly passes, allowing the system to credit nearly the maximum int64 value of that token. This flaw is an integer overflow (CWE‑190) and enables an authorized actor to mint an effectively unlimited quantity of a semi‑fungible token, corrupting the on‑chain supply counter and compromising data integrity.

The vulnerability resides in the klever-io:klever-go implementation of the Klever blockchain protocol. Versions prior to 1.7.19 are exposed; those releases include the semi‑fungible token add‑quantity path that contains the unchecked signed addition. Users of any earlier release are at risk, while updates v1.7.19 and later contain the fix that orders the MaxSupply check before the addition and enables the consensus activation flag "FixMarketBuyOverflow".

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS score is not available, so the precise likelihood of exploitation cannot be quantified, but the attack requires only mint‑role credentials and no external vulnerabilities. The flaw is not yet listed in CISA’s KEV catalog, indicating no known widespread active exploitation. The anticipated attack vector is internal: a privileged actor on the network who can invoke the mint function can trigger the overflow.