# Collateral can be enabled despite pause/freeze or invalid pricing

K2's transfer and collateral-enable paths skip pause/freeze and oracle checks, letting paused reserves back new borrows and dust transfers grief victims.

- Payout: Contest reward
- Severity: medium
- Program: K2
- Credited: v12
- Disclosed: 2026-08-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2026-04-k2#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-02
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:access-control vuln:business-logic vuln:dos vuln:oracle-manipulation

**Target:** KineticRouter / AToken collateral-enable and transfer paths (Rust contracts)
**Root cause:** Collateral-eligibility checks are fragmented: validate_and_finalize_transfer and set_user_use_reserve_as_coll set the UserConfiguration collateral bit without a shared pause/freeze and oracle-validity check, and downstream accounting trusts that bit.
**Steps:**
1. Call `ATokenContract::transfer_internal` to move existing aTokens to a recipient so `to_balance_after > 0`.
2. `KineticRouter::validate_and_finalize_transfer` auto-sets the recipient's collateral bit for that reserve without checking pause/freeze or oracle validity.
3. Alternatively call `set_user_use_reserve_as_coll` to re-enable a paused/frozen reserve as collateral.
4. Borrow against the now-counted collateral in another market, or send dust aTokens to force the flag on a victim during a stale/zero-price window.
**How found:** Code review comparing collateral-enablement entrypoints; noticed validate_and_finalize_transfer and set_user_use_reserve_as_coll set the collateral bit without the eligibility/oracle checks used on other paths.
**Exploitation:** Attacker transfers aTokens (or dust) to a target so the auto-enable path sets the collateral bit, then borrows against paused/frozen or mispriced collateral; against a victim, repeated dust transfers force the collateral flag and block borrow/withdraw until cleared.
**Escalation:** Chaining the auto-enabled collateral bit into borrow/health-factor accounting lets paused or depegged reserves back fresh debt, risking undercollateralization.
**Insight:** When a protocol has multiple paths that set the same authorization bit (collateral enablement), diff each path's guard conditions; transfer-triggered auto-enable is a commonly missed entrypoint that bypasses pause/freeze and oracle checks.