# Every flash liquidation permanently drains the debt-asset reserve, making depositors unable to withdraw their funds

K2 Kinetic Router's internal flash liquidation returns the aToken's own funds as 'repayment', stranding debt_to_cover on the router and permanently shrinking the reserve each liquidation.

- Payout: Contest reward
- Severity: high
- Program: K2
- Credited: juldesbourds
- Disclosed: 2026-08-20
- Write-up quality: 8/10
- Original: https://code4rena.com/reports/2026-04-k2#h-05
- Library page: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-05
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:rust technique:chained technique:source-review vuln:accounting-error vuln:business-logic vuln:flash-loan

**Target:** Soroban (Stellar) lending router flash-liquidation path
**Root cause:** verify_repayment only checks the aToken regained its starting balance, which trivially passes since the flash loan is repaid with the aToken's own funds; no post-condition requires net-new underlying or zero router residual.
**Steps:**
1. Call execute_liquidation on an undercollateralized position; router mints internal flash loan of actual_debt_to_cover from aToken to pool.
2. In execute_liquidation_callback, burn borrower debt, seize collateral, swap collateral to debt asset (debt_received).
3. Pool transfers actual_debt_to_cover back to aToken as 'repayment'; verify_repayment passes because balance >= initial_balance.
4. Pool pays protocol_fee and liquidator profit from debt_received; residual actual_debt_to_cover remains on router address.
5. Repeat across liquidations; aToken underlying shortfall grows by sum of actual_debt_to_cover, blocking LP withdrawals.
**How found:** Code review of execute_liquidation_callback fund flow: noticed the circular aToken->pool->aToken transfer and that verify_repayment compares against initial_balance, so repayment is the loan itself; traced residual balance arithmetic to find debt_to_cover stranded on router.
**Exploitation:** Any liquidator triggers flash liquidation on a liquidatable position; each call leaves actual_debt_to_cover of debt asset trapped on the router, monotonically reducing reserve solvency until depositor withdrawals revert.
**Escalation:** Shortfall compounds monotonically across liquidations; during market downturns mass liquidations rapidly drain reserves, causing protocol insolvency.
**Insight:** In flash-loan-funded liquidation designs, check that repayment verification requires net-new value (e.g., router debt-asset balance == 0 after callback), not just that the lender's balance is restored—circular flows trivially satisfy balance checks.