CVE-2026-82406

The Klever-Go blockchain protocol implementation contains a high-severity vulnerability in the native marketplace function located at core/kapp/market/market.go. The Buy() function fails to verify the IsClaimed status before accepting a bid, while other functions like Claim and CancelOrder do enf...

Seller can steal all the bid fund by repeatedly calling finalize()

Lines of code Vulnerability details Impact Bidders' fund will be stolen by malicious seller, they can not get refund. Proof of Concept In finalize, FinalizeData memory data is local, which means in each call, data is re-initialized. By calling finalize multiple times, a malicious seller can get t...