# Global pause can be bypassed via direct aToken transfers, breaking containment across remediation

K2's global pause blocks router entrypoints but not direct aToken.transfer(), letting users move paused collateral to fresh addresses and redeem after remediation.

- Payout: Contest reward
- Severity: medium
- Program: K2
- Credited: hodlturk
- Disclosed: 2026-08-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2026-04-k2#m-23
- Library page: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-23
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Soroban aToken contract transfer path and router validate_and_finalize_transfer hook
**Root cause:** The global pause check exists on router entrypoints but is absent from the public aToken.transfer() path and the router's validate_and_finalize_transfer() finalization hook, so transfers still mutate balances and collateral ownership during pause.
**Steps:**
1. Attacker supplies collateral, receives aTokens.
2. Admin calls pause(); router withdraw() is blocked.
3. Attacker calls `aToken.transfer(from, fresh_address, amount)` directly on the aToken contract.
4. transfer_internal() invokes router `validate_and_finalize_transfer()` which finalizes without checking `storage::is_paused()`.
5. Admin blacklists/remediates original address during pause.
6. After unpause, fresh address calls withdraw() and receives underlying.
**How found:** Compared documented pause invariant ('blocks all state-changing operations') against router entrypoints, then traced the public aToken.transfer() path into the router's validate_and_finalize_transfer() hook and noticed no is_paused() guard.
**Exploitation:** Any aToken holder directly invokes the public aToken transfer during a protocol pause, moving collateral to a clean address; the router hook finalizes the transfer without a pause guard, so the position survives blacklisting of the original address and is redeemed after unpause.
**Insight:** When a protocol documents a global pause invariant, enumerate every public token-side entrypoint and its router callbacks, not just router functions—token contracts often hold unguarded state-mutating paths that bypass the pause boundary.