highCVE-2026-55764Aug 28, 2026

CVE-2026-55764: klever-go SFT Add-Quantity int64 Overflow Bypasses Per-Nonce MaxSupply

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A missing overflow guard in klever-go's SFT mint path lets anyone with a mint role bypass a nonce's declared maximum supply and mint up to ~9.2 quintillion tokens in a single transaction.

Packagegithub.com/klever-io/klever-go
Ecosystemgo
Affected< 1.7.19
Fixed in1.7.19
CVE-2026-55764: klever-go SFT Add-Quantity int64 Overflow Bypasses Per-Nonce MaxSupply

The problem

In core/kapp/systemAccount/systemAcount.go, the function SFTAddCirculation does meta.Circulation += amount with no overflow check before comparing meta.Circulation > meta.MaxSupply. If amount is near math.MaxInt64, the addition wraps the signed counter negative.

A negative value is never greater than a positive MaxSupply, so the cap check silently passes and the function returns nil.

The practical impact is severe: a mint-role holder can issue ~9.2e18 tokens for a nonce declared with MaxSupply = 1000, with no debit from any reserve and no on-chain error. The Circulation counter is left at a large negative value, corrupting any market or indexer that reads it.

The fungible mint path is NOT vulnerable because it already has a MintedValue <= 0 post-increment guard that the SFT path was missing.

Proof of concept

A working proof-of-concept for CVE-2026-55764 in github.com/klever-io/klever-go, with the exact payload below.

json
// On-chain AssetTrigger Mint transaction (chainID 420420, block 484)
// SFT nonce F05-2SDF/1 has MaxSupply = 1000. Send amount = MaxInt64 to a fresh receiver.
// Result: resultCode Ok, Transfer receipt for 9223372036854775807 tokens. No MaxSupplyExceeded.
{
  "contract": [
    {
      "type": 11,
      "typeString": "AssetTriggerContractType",
      "parameter": {
        "triggerType": "Mint",
        "assetId": "F05-2SDF/1",
        "toAddress": "klv1qeh4py4p5zzy94l2hnygpfklug82gpzw08u680ycwp00njxyhgdqcv2xjm",
        "amount": 9223372036854775807
      }
    }
  ]
}

The root cause is CWE-190 (Integer Overflow or Wraparound). The unguarded meta.Circulation += amount in SFTAddCirculation causes a two's-complement wrap when Circulation (seeded at 5) plus amount (MaxInt64 = 9223372036854775807) exceeds math.MaxInt64.

The result is -9223372036854775804, which is less than MaxSupply (1000), so the signed comparison meta.Circulation > meta.MaxSupply evaluates false and no error is returned.

The patch (commit 8bcc600b) adds a post-increment guard: if meta.Circulation < 0 after the addition, the function returns ErrSupplyNotValid, mirroring the MintedValue <= 0 guard already present on the fungible mint path at mint.go:289. The fix is gated behind an activation flag because it is consensus-affecting.

The fix

Upgrade to klever-go v1.7.19 (patch commit 8bcc600b0ac88070740c63c7ce1c8a968dd85251). The fix adds a negative-result guard inside SFTAddCirculation immediately after the += and before the MaxSupply comparison. Nodes that do not upgrade will accept on-chain mints of MaxInt64 tokens for any SFT nonce regardless of its declared cap.

Reporter not attributed.

References: [1][2][3][4]

Related research