# Emergency admin can unpause reserves, breaking pause asymmetry

PoolConfigurator's set_reserve_pause uses validate_emergency_admin for both directions, letting a compromised emergency admin unpause reserves and bypass the pause asymmetry invariant.

- Payout: Contest reward
- Severity: medium
- Program: K2
- Credited: v12
- Disclosed: 2026-08-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2026-04-k2#m-08
- Library page: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-08
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:incomplete-fix technique:source-review vuln:access-control vuln:business-logic

**Target:** PoolConfigurator reserve pause function (contracts/pool-configurator/src/reserve.rs)
**Root cause:** set_reserve_pause gates both pause and unpause behind validate_emergency_admin (emergency admin OR pool admin) instead of restricting unpause to validate_admin (pool admin only), unlike emergency.rs which enforces the asymmetry.
**Steps:**
1. Identify that emergency.rs pause() uses validate_emergency_admin while unpause() uses validate_admin, per M-04 fix.
2. Read set_reserve_pause in reserve.rs L334 and observe it calls validate_emergency_admin for both paused=true and paused=false.
3. As emergency admin, call `set_reserve_pause(asset, false)` on an individually-paused reserve.
4. Observe the reserve becomes unpaused, bypassing the pool-admin-only unpause invariant.
**How found:** Compared access-control modifiers across the pause system: noticed emergency.rs intentionally splits pause/unpause privileges (M-04 fix) and checked whether PoolConfigurator's reserve-level pause honored the same asymmetry, finding it used validate_emergency_admin for both directions.
**Exploitation:** A compromised emergency admin key calls set_reserve_pause(asset, false) to re-enable operations on a reserve the pool admin deliberately paused (e.g. due to exploit or oracle issue), undoing the protective pause.
**Insight:** When a protocol documents an intentional privilege asymmetry (pause vs unpause), audit every sibling pause function across modules for the same split; reserve-level and global-level pause paths often diverge.