# Reserve accounting breaks fee collection when debt exceeds supply

K2's reserve view and collection revert with InvalidAmount when accrued debt exceeds supplier supply, bricking protocol fee collection under high utilization.

- Payout: Contest reward
- Severity: medium
- Program: K2
- Credited: v12
- Disclosed: 2026-08-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2026-04-k2#m-18
- Library page: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-18
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:accounting-error vuln:dos

**Target:** KineticRouter reserve accounting (get_protocol_reserves / collect_protocol_reserves)
**Root cause:** get_protocol_reserves and collect_protocol_reserves assume total_borrow <= total_supply, but borrow rate compounding above liquidity rate with reserve_factor diversion lets debt outgrow supplier claims.
**Steps:**
1. Reach high utilization so borrow interest (higher rate) compounds faster than supplier balances (lower rate), with spread diverted to reserves.
2. Observe total_borrow > total_supply in the market state.
3. Call `get_protocol_reserves` -> reverts/returns InvalidAmount due to `total_supply - total_borrow` underflow check.
4. Call `collect_protocol_reserves` -> same check bricks treasury withdrawal.
**How found:** Noticed calculate_interest_rates_for_reserve already treats total_debt >= total_supply as a valid high-utilization state (clamping liquidity, emitting insolvent), revealing the reserve path's total_borrow <= total_supply assumption is inconsistent.
**Exploitation:** No attacker action; state arises naturally from normal interest accrual under sustained high utilization, causing reserve view and collection to revert.
**Insight:** When one code path models debt>=supply as valid but another treats it as an error, that inconsistency is a bug signal; check whether interest-rate spreads and reserve_factor diversion can naturally violate supply>=borrow invariants.