# Reserve-slot squatting DoS via forced aToken recipient collateral bit

K2 router auto-sets recipient collateral bit on any aToken transfer, letting an attacker dust 15 reserves to saturate a victim's MAX_USER_RESERVES bitmap and block new supplies or aToken-path liquidations.

- Payout: Contest reward
- Severity: medium
- Program: K2
- Credited: coinsspor
- Disclosed: 2026-08-20
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2026-04-k2#m-07
- Library page: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:rust tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:liquidation

**Target:** Kinetic router aToken transfer finalization and liquidation path
**Root cause:** validate_and_finalize_transfer unconditionally sets is_using_as_collateral=true on any aToken recipient with nonzero balance, with no consent gate; combined with the K2-specific MAX_USER_RESERVES=15 cap, dust transfers saturate the victim's user-config bitmap.
**Steps:**
1. Attacker supplies MIN_FIRST_DEPOSIT=1000 wei into each of 15 configured reserves.
2. Attacker sends 1 wei of each corresponding aToken to the victim, triggering `validate_and_finalize_transfer` and flipping the collateral bit per reserve.
3. Victim's `count_active_reserves()` reaches 15.
4. Victim's next `supply()` into a 16th reserve panics with `MaxUserReservesExceeded` at operations.rs:104.
5. For liquidator DoS: borrower squats a target liquidator's 15 slots, price drops HF<1, liquidator calls `liquidation_call(..., _receive_a_token=true)` which reverts `InvalidLiquidation` at liquidation.rs:417-419.
**How found:** Code review comparing K2's validate_and_finalize_transfer against Aave V3's SupplyLogic.executeFinalizeTransfer, noticing the recipient-side collateral bit flip is K2-introduced and interacts badly with the reduced MAX_USER_RESERVES=15 cap.
**Exploitation:** Attacker (or underwater-prone borrower via Sybil) spends ~15k wei total to dust 15 distinct aTokens to a victim/liquidator address, saturating the bitmap. Victim cannot open new reserve positions; liquidator bots using the aToken-receive path are selectively disabled, forcing the underlying-receive fallback which may fail under liquidity stress, delaying liquidations and accruing bad debt.
**Escalation:** Chains a benign auto-collateral UX behavior with the K2-specific 15-reserve cap to convert a dust transfer into a targeted liquidation-bot DoS; fallback path may fail during market stress when aToken underlying liquidity is drained.
**Insight:** When a fork diverges from its upstream (here Aave V3), diff the changed semantics against protocol-specific constants like reduced per-user reserve caps; a UX convenience that auto-mutates recipient state becomes a griefing primitive when a hard cap turns it into a revert.