# Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

Klever-Go marketplace Buy lacks the IsClaimed guard, letting a settled 'zombie' auction accept new bids whose funds are burned and siphoned to the prior bidder.

- Payout: Research
- Severity: high
- Program: Klever-Go
- Found by: mabdullah22
- Disclosed: 2026-09-23
- CVE: CVE-2026-82406
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-26r5-4mm2-px5c
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-26r5-4mm2-px5c
- Tags: area:web domain:web impact:funds-loss kind:research platform:ghsa sev:high tech:go technique:incomplete-fix technique:source-review vuln:access-control vuln:business-logic

**Target:** Native marketplace KApp Buy handler (core/kapp/market/market.go)
**Root cause:** Buy() never checks IsClaimed, and the early seller-accept settle path in Claim/executeBuyMarket sets IsClaimed=true without resetting EndTime or deleting the order, leaving a settled order that still looks live and biddable.
**Steps:**
1. Create a resting-bid auction (Price=0, ReservePrice>0) for an NFT and self-bid X as Sybil bidder A via `Buy`.
2. Seller accepts A's bid early via `Claim` (seller-accept branch) -> IsClaimed=true, NFT to A, payout to seller, EndTime unchanged, order still loadable.
3. Victim B calls `Buy` with Y > X on the zombie order; Buy succeeds, debits Y from B, refunds X to A.
4. B becomes CurrentBidder on a claimed order; `Claim` and `CancelOrder` both revert Transaction_ParameterInvalid, so Y is unrecoverable.
**How found:** Compared guard placement across handlers: IsClaimed is enforced in Claim, CancelOrder and orderEscrowAmount but absent in Buy; then noticed the early seller-accept settle path uniquely fails to reset EndTime or delete the order, producing a settled-but-live order.
**Exploitation:** Attacker controls both seller and prior bidder (Sybil), so the NFT stays with them and the owner payout returns to them; each victim bid Y on the zombie order is burned, with X refunded to the attacker and Y-X destroyed. Repeatable across many bait orders; no privileged role needed.
**Escalation:** Repeatable across many bait orders; each victim yields ~X to the attacker while the NFT is retained.
**Insight:** When a state flag like IsClaimed gates some handlers, enumerate every handler that mutates the same order and check each one; also diff settle paths for post-settlement cleanup (EndTime reset, order deletion) since one path skipping cleanup creates a zombie object other handlers still accept.

## Proof of concept (copied exactly from the original report)

**Command to run the PoC test**

```
cd klever-go
GOTOOLCHAIN=auto go test ./core/kapp/market/ -run TestPoC_ZombieOrder_MissingIsClaimedGuardInBuy -v
```