klever-io vulnerabilities

Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller

klever-io · klever-go

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

klever-io · klever-go

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

klever-io · klever-go

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

klever-io · klever-go

Klever-Go: /log controls global node logging

klever-io · klever-go

Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

klever-io · klever-go

Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply

klever-io · klever-go

Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits

klever-io · klever-go

Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

klever-io · klever-go

Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

klever-io · klever-go