Klever-Go KVM read-only execution can commit contract delete and upgrade side effects
Publisher note
Fixed in v1.7.17. Operators running < v1.7.17 should upgrade. Contract delete and upgrade host-core paths now reject execution when runtime.ReadOnly() is true. The invariant is regression-tested for delete, upgrade, storage writes, value transfers, and any VM output field that can later mutate chain state.
Patch commits on develop: 333f6ec9, 68b94a40 (merged from private fork associated with the original advisory).
This advisory was originally filed jointly with a separate P2P throttler DoS finding, now tracked under GHSA-74m6-4hjp-7226 so each issue receives its own CVE.
The original disclosure from @LoGGGG240211 follows verbatim, including the embedded proof-of-concept source.
Private Vulnerability Report
Repository: klever-io/klever-go Reviewed commit: 405d01b0abbf0d3e73b4a990bd7394a01f200dc2 Disclosure channel: GitHub Private Vulnerability Reporting Reporter GitHub account: LoGGGG240211
2.2 KVM read-only execution can commit contract delete side effects
Severity : Medium Confidence : HIGH Attack Complexity : MEDIUM PoC Status : Confirmed
Description
KVM exposes ExecuteReadOnlyWithTypedArguments as a read-only execution mechanism. The hook saves the previous read-only state, sets runtime.SetReadOnly(true), executes the destination context, and then restores the previous read-only state. However, the indirect contract delete and upgrade paths do not reject execution when runtime.ReadOnly() is true. As a result, a contract reached through read-only execution can call the production delete hook for a target contract it owns. The delete path appends the target address to vmOutput.DeletedAccounts, the output context merges DeletedAccounts into the caller output, and the smart contract processor later processes the VM output by deleting accounts listed in that field.
The root cause is that read-only mode is applied as runtime state, but not enforced by the state-changing delete and upgrade host-core paths. This breaks the expected isolation boundary for workflows that rely on read-only calls to inspect another contract without allowing that callee to produce state-changing VM output.
Location
- baseOps.go, ExecuteReadOnlyWithTypedArguments(), line 2097
- baseOps.go, ExecuteReadOnlyWithTypedArguments(), line 2099
- execution.go, doExecContractDelete(), line 237
- execution.go, doExecContractDelete(), line 246
- execution.go, executeUpgrade(), line 792
- execution.go, executeUpgrade(), line 831
- execution.go, executeDelete(), line 839
- execution.go, executeDelete(), line 849
- output.go, PopMergeActiveState(), line 103
- output.go, mergeVMOutputs(), line 615
- process.go, processVMOutput(), line 755
- process.go, processVMOutput(), line 765
Preconditions
- A contract workflow invokes a callee through KVM read-only execution.
- The read-only callee owns, or otherwise satisfies the upgrade/delete permission checks for, the target contract.
- The target contract is upgradeable/deletable according to its KVM code metadata.
- No node operator privilege, validator role, oracle condition, or block-level timing condition is required.
Impact
Successful exploitation violates KVM read-only isolation and allows state-changing delete side effects to be produced from a read-only nested execution. The PoC demonstrates that DeletedAccounts changes from zero entries before execution to one target entry after execution. Practical impact depends on contract workflows that trust read-only calls as non-mutating. In such workflows, an attacker-controlled or untrusted callee could hide delete or upgrade effects behind a read-only call. The delete effect is reversible only through redeployment or state recovery procedures available to the protocol or contract owner.
Exploit Cost
The cost is normal KVM smart contract execution gas. No flash loan, collateral, oracle manipulation, or external capital requirement is needed. The attacker must satisfy the contract-level preconditions above.
Steps to Reproduce
- Place
poc_kvm_readonly_delete_side_effect_test.goin an empty directory. - Run the dependency commands listed in the PoC header.
- Run
GOTOOLCHAIN=go1.25.9 go test -v poc_kvm_readonly_delete_side_effect_test.go. - Observe that the parent contract invokes a child contract through
ExecuteReadOnlyWithTypedArguments. - Observe that the child contract uses the production managed delete hook against a target contract it owns.
- Observe that the final VM output contains the target address in
DeletedAccountsdespite the delete action being triggered through read-only execution.
Proof-of-Concept Result
Running GOTOOLCHAIN=go1.25.9 go test -v poc_kvm_readonly_delete_side_effect_test.go after dependency setup produces the following output. The result confirms that read-only execution commits a delete side effect into VM output.
# command-line-arguments.test
/usr/bin/ld: warning: bint-x64-amd64.o: missing .note.GNU-stack section implies executable stack
/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
=== RUN TestPoC_KVMReadOnlyCanCommitDeleteSideEffect
poc_kvm_readonly_delete_side_effect_test.go:90: deleted_accounts_before=0
poc_kvm_readonly_delete_side_effect_test.go:91: deleted_accounts_after=1
poc_kvm_readonly_delete_side_effect_test.go:92: target_deleted=true
--- PASS: TestPoC_KVMReadOnlyCanCommitDeleteSideEffect (0.00s)
PASS
ok command-line-arguments 0.007sSuggested Fix
Enforce read-only mode in every state-changing KVM host path. At minimum, reject contract delete and contract upgrade execution when runtime.ReadOnly() is true. The same invariant should be regression-tested for delete, upgrade, storage writes, value transfers, and any VM output field that can later mutate chain state.
Proof-of-Concept Source
poc_kvm_readonly_delete_side_effect_test.go
```go package poc
/* Target contract : Klever-Go KVM VM host hooks and smart contract processor; no on-chain address Vulnerability : Read-only execution isolation bypass with contract delete side effect Severity : Medium How to run : GOTOOLCHAIN=go1.25.9 go test -v poc_kvm_readonly_delete_side_eff