# Deficit treated as available liquidity

K2's interest-rate update computes available liquidity as total_supply minus total_debt, ignoring stored reserve deficit, so bad-debt reserves reprice borrow rates artificially low.

- Payout: Contest reward
- Severity: high
- Program: K2
- Credited: v12
- Disclosed: 2026-08-20
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2026-04-k2#h-07
- Library page: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:rust technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** Kinetic router interest rate calculation (calculation.rs)
**Root cause:** calculate_interest_rates_for_reserve derives utilization and available_liquidity from total_supply - total_debt, but liquidation flows burn unrecoverable debt into reserve_deficit without restoring underlying, so the invariant breaks and rates are written too low.
**Steps:**
1. Trigger a liquidation that burns unrecoverable debt and calls `storage::add_reserve_deficit(...)`, removing it from total_debt without adding underlying.
2. Call `update_interest_rates_and_store` -> `calculate_interest_rates_for_reserve`.
3. Observe available_liquidity = total_supply - total_debt ignores the stored deficit and actual aToken balance.
4. Resulting current_variable_borrow_rate and current_liquidity_rate are written artificially low.
5. Borrower opens/maintains debt at discounted rate while reserve is actually short of underlying.
**How found:** Code review of the rate update path: noticed the borrow path checks real aToken cash but the rate recalculation trusts total_supply - total_debt, and that liquidation flows book deficit separately, breaking that invariant.
**Exploitation:** After a bad-debt event externalizes deficit, any borrower can keep debt in the reserve at a systematically discounted interest rate until treasury/admins cover the hole, leaking yield from suppliers and treasury proportional to deficit size and lifetime.
**Insight:** When a protocol externalizes bad debt into a separate accounting bucket, audit every downstream computation that still trusts the old supply-minus-debt invariant; rate oracles and utilization math are prime spots where the deficit silently vanishes.