Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a valid listing and then use AssetTrigger UpdateRoyalties to make the combined referral and royalty percentages exceed the bid. executeBuyMarket pays referral and royalty amounts unconditionally while computeMarketOwnerAmount silently skips a nonpositive seller remainder, allowing MarketBuy, BuyItNow, or auction Claim settlement to credit more KLV or sale currency than the buyer paid. This can create unbacked currency and corrupt token supply integrity. This issue is fixed in version 1.7.19.

CVE-2026-54754 affects Klever-Go, the Go implementation of the Klever blockchain protocol, in versions prior to 1.7.19. The vulnerability exists in the marketplace settlement logic in core/kapp/market/market.go, where MarketOrderData.ReferralPercentage is read from the listing at creation time while asset.Royalties.MarketPercentage is read live at purchase time. An attacker who owns an asset can create a valid listing and subsequently use AssetTrigger UpdateRoyalties to inflate combined referral and royalty percentages beyond the bid amount. The functions executeBuyMarket and computeMarketOwnerAmount fail to properly validate these combined percentages, allowing settlement to credit more KLV or sale currency than the buyer actually paid. This logic flaw enables the creation of unbacked currency and corrupts token supply integrity across MarketBuy, BuyItNow, and auction Claim settlement flows. The vulnerability is fixed in version 1.7.19.