The vulnerability arises from the missing `IsClaimed` guard in the `Buy` function of Klever-Go's native marketplace. This omission allows a seller to settle a resting‑bid auction while the order remains claimable, leaving the claimed order’s loadable with a future EndTime and stale bid data. A subsequent bidder can then submit a higher bid, be debited, and trigger a refund to the previous bidder even though the NFT has already been delivered. Because Claim and CancelOrder actions reject a later bidder when `IsClaimed` is true, the later bidder cannot obtain the NFT or recover the funds. This flaw permits unauthorized transfer or theft of NFTs and loss of payment for legitimate buyers.

Klever-Go, the Go implementation of the Klever blockchain protocol, is impacted on all releases before 1.7.20. The issue is specific to the core/kapp/market/market.go Buy operation used in the native marketplace.

The CVSS score of 7.1 classifies the flaw as high severity, and the KEV status indicates no current exploitation reports. The EPSS score is not available, so the current exploitation probability cannot be quantified. The attack vector likely involves interacting with the marketplace API to place bids after an auction has been settled but before it has been claimed, a scenario that a malicious user can orchestrate without elevated privileges. If successful, the attacker can cause a loss of assets for honest participants while keeping the stolen NFT. The lack of an active workaround underscores the importance of applying the vendor patch.