# Users can bypass the first deposit check

Dust AToken transfer makes is_first_supply false, bypassing MIN_FIRST_DEPOSIT and oracle checks on first supply in K2.

- Payout: Contest reward
- Severity: medium
- Program: K2
- Credited: Kalogerone
- Disclosed: 2026-08-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2026-04-k2#m-11
- Library page: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:business-logic vuln:oracle-manipulation vuln:share-inflation

**Target:** KineticRouter supply operation and a-token mint_scaled
**Root cause:** is_first_supply is derived from current_scaled_balance == 0 in mint_scaled; any external AToken transfer sets scaled balance > 0, so the first-supply branch (MIN_FIRST_DEPOSIT, oracle check, collateral bit) is skipped.
**Steps:**
1. Attacker identifies a user with zero AToken balance who never supplied.
2. Attacker transfers 1 wei of AToken to that user, setting their scaled balance > 0.
3. User calls supply(); mint_scaled computes is_first_supply = false.
4. MIN_FIRST_DEPOSIT check, verify_oracle_price_exists_and_nonzero, and set_using_as_collateral are all skipped.
5. User supplies into an unpriced reserve, earning yield while HF math reverts for withdrawal-with-debt and liquidation.
**How found:** Code reading of supply() first-supply branch and mint_scaled()'s is_first_supply derivation from scaled balance; noticed external AToken transfers can flip the flag.
**Exploitation:** Griefing/self-setup: transfer 1 wei AToken to target, then supply below MIN_FIRST_DEPOSIT into a reserve lacking a valid oracle price; collateral bit stays unset and HF math reverts, breaking withdrawal-with-debt and liquidation.
**Escalation:** Potential share inflation attack enabled by bypassing MIN_FIRST_DEPOSIT, per the M-04 comment.
**Insight:** When a 'first deposit' guard keys off token balance rather than a per-user/per-reserve initialization flag, any external transfer (even 1 wei) can flip the branch; check whether the guard state is attacker-influenceable via direct token transfers.