# AMM quote overflow can disable swaps and liquidations

AMM quote helper multiplies amount_in_with_fee by reserve_out in i128, overflowing for 18-decimal reserves and reverting swaps and liquidations.

- Payout: Contest reward
- Severity: medium
- Program: K2
- Credited: v12
- Disclosed: 2026-08-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2026-04-k2#m-22
- Library page: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-22
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** Solidity AMM quote helper and KineticRouter liquidation callback
**Root cause:** calculate_amount_out performs the constant-product numerator multiplication (amount_in_with_fee * reserve_out) in native i128, so valid 18-decimal reserve/swap values exceed i128::MAX and checked_mul returns None, reverting the quote.
**Steps:**
1. Identify dex::calculate_amount_out computing `amount_in_with_fee * reserve_out` in i128.
2. Choose 18-decimal token reserves and swap size such that the product exceeds i128::MAX (~1.7e38).
3. Call swap or liquidation path (swap_collateral / executeLiquidationCallback) that invokes calculate_amount_out.
4. Observe checked_mul returns None and the transaction reverts.
5. Optionally inflate external pool reserves to force the overflow condition persistently.
**How found:** Code review of the AMM invariant math noting i128 intermediate multiplication against realistic 18-decimal reserve magnitudes.
**Exploitation:** Attacker inflates external pool reserves so calculate_amount_out consistently overflows, causing liquidation swaps and flash-liquidation callbacks to revert for targeted underwater positions, preventing unwinding and leaving bad debt.
**Escalation:** Reserve inflation turns a bounded-input overflow into a persistent DoS on liquidation routes for targeted positions.
**Insight:** When auditing constant-product AMM math, check the integer width of the intermediate `amount_in_with_fee * reserve_out` product against realistic 18-decimal reserve depths, not just the final output range.