Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Summary

The per-entry percentages of a KDA asset's split royalties are validated by summing

them into a uint32 accumulator and checking the sum against HundredPercent (10000),

with no upper bound on each individual entry. Two split entries whose percentages sum to

just over 2^32 wrap around below 10000 and pass validation, while each stored value

remains astronomically large (e.g. 0x80000000 = 2,147,483,648 ≈ 21,474,836%).

At royalty payout, each split recipient is credited pool × hugePct / 10000 — far more than

the royalty pool — and the resulting negative remainder is silently discarded

(if royaltiesToPay This is independent of, and not mitigated by, the existing FixMarketBuyOverflow` guard.

Affected component

• Repository: klever-io/klever-go (node).

• Validation: core/process/kda/assetHelper.go, core/kapp/kda/create.go,

core/kapp/kda/trigger.go, core/kapp/builtInFunctions/utils.go.

• Payout (mint sites): core/kapp/accounts/accounts.go (transfer), core/kapp/market/market.go

(marketplace buy), core/kapp/ito/ito.go (ITO buy).

• Not gated by any fork flag — exploitable on current mainnet.

Root cause

1. Per-entry split percentages are decoded as raw uint32 with no bound

core/kapp/builtInFunctions/utils.go — decodeSplitInfo (≈L292):

func decodeSplitInfo(buf *bytes.Reader, splitInfo *transaction.RoyaltySplitInfo) error {
	fields := []*uint32{
		&splitInfo.PercentTransferPercentage,
		&splitInfo.PercentTransferFixed,
		&splitInfo.PercentMarketPercentage,
		&splitInfo.PercentMarketFixed,
		&splitInfo.PercentITOPercentage,
		&splitInfo.PercentITOFixed,
	}
	for _, field := range fields {
		if err := binary.Read(buf, binary.BigEndian, field); err != nil { // no 
			return err
		}
	}
	return nil
}