# internal_liquidation_call validates close factor before min_remaining_debt bump, allowing liquidators to seize 100% of debt when only 50% is permitted

K2 liquidation validates 50% close factor before min_remaining_debt bump escalates debt_to_cover to 100%, letting liquidators seize full collateral.

- Payout: Contest reward
- Severity: high
- Program: K2
- Credited: harshsukhii
- Disclosed: 2026-08-20
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2026-04-k2#h-06
- Library page: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:rust technique:source-review vuln:business-logic vuln:liquidation

**Target:** Kinetic router liquidation module (liquidation.rs)
**Root cause:** Close factor is validated against caller-supplied debt_to_cover before the min_remaining_debt logic silently bumps debt_to_cover to the full debt balance; the bumped value is used for liquidation without re-validating the close factor.
**Steps:**
1. Configure reserve with min_remaining_debt such that remaining after 50% liquidation falls below it (e.g. debt 39,000, min_remaining_debt 19,501).
2. Ensure borrower HF in (0.5 WAD, 1.0 WAD) with individual debt and collateral ≥ $2,000 so 50% close factor applies.
3. Call `liquidation_call` with `debt_to_cover = 19,500` (exactly 50%).
4. CF validation passes (19,500 ≤ 19,500).
5. Remaining 19,500 < 19,501 triggers bump to full debt_balance 39,000.
6. Liquidation executes on 39,000 debt, seizing 100% of collateral while liquidator pays only the declared 50%.
**How found:** Code review of internal_liquidation_call noticed close-factor validation (L234-237) and the min_remaining_debt bump (L239-262) are decoupled: validation runs on the original debt_to_cover, but the bumped value is used downstream without a second CF check.
**Exploitation:** Liquidator submits liquidation_call with debt_to_cover equal to the 50% close-factor cap; the min_remaining_debt bump escalates the covered debt to the full balance, so the liquidator repays only the declared 50% amount but seizes the borrower's entire collateral in one transaction.
**Insight:** When a function validates a user-supplied amount then mutates that amount before use, check whether the mutation can exceed the validated bound; dust-prevention/min-amount clamps are a common place for such post-validation escalation.