A critical logic flaw in the Klever-Go blockchain protocol allows unauthenticated attackers to trigger unauthorized token inflation, posing a severe risk to the integrity of the KDA asset.

This vulnerability is a flaw in the enforcement of behavioral workflows (CWE-841) within the processPercentageRoyaltiesTransfer function, where an early return prevents the debiting of a sender account during a specific royalty split configuration. This allows an unauthenticated user to trigger a minting event without a corresponding deduction, effectively bypassing the protocol's accounting logic.

The exploitation of this vulnerability results in the unauthorized creation of KDA tokens, leading to direct financial loss and the devaluation of the asset through unbounded inflation. With a CVSS score of 8.7, this issue is rated as High severity, reflecting the potential for significant economic disruption and a complete loss of trust in the blockchain platform's transactional integrity.

Immediate Action: Upgrade all instances of klever-go to version 1.7.19 or later to implement the corrected royalty distribution logic.

Proactive Monitoring: Monitor blockchain transaction logs for anomalous transfer patterns, specifically looking for royalty transfers where the source account balance remains unchanged despite successful distribution to recipients.

Compensating Controls: While standard network-level WAFs cannot mitigate this logic flaw, implement strict monitoring at the smart contract level to identify and flag accounts or assets utilizing the 100 percent TransferPercentage royalty configuration.

Public Exploit Available: No

The severity of this vulnerability necessitates an immediate update to version 1.7.19. Administrators must prioritize this patch to prevent potential exploitation that could lead to irreversible financial damage and protocol-wide inflation. Testing the update in a staging environment is advised to ensure compatibility with existing smart contract configurations before production deployment.