# Prepared flash liquidation can bypass collateral reserve pause

K2 flash liquidation validates reserve pause only at prepare time, letting a prepared authorization settle against a collateral reserve paused within the 600s window.

- Payout: Contest reward
- Severity: medium
- Program: K2
- Credited: bunnyhunter
- Disclosed: 2026-08-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2026-04-k2#m-24
- Library page: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-24
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** Soroban lending router (prepare_liquidation/execute_liquidation)
**Root cause:** execute_liquidation reloads both reserves but never re-checks is_active()/is_paused() on the collateral reserve; the flash-loan loop only validates the debt asset, so prepare-time validation is treated as still valid across transactions.
**Steps:**
1. Call `prepare_liquidation` on an undercollateralized position while collateral reserve is unpaused; receive authorization valid 600s.
2. Admin pauses the collateral reserve (emergency stop).
3. Within 600s call `execute_liquidation` with same params; only protocol-wide pause and authorization/price/deadline checks run.
4. Reserves reloaded via `update_state` with no lifecycle check; flash loan validates only debt asset.
5. Callback burns borrower aTokens, seizes collateral, swaps via DEX on the paused reserve.
**How found:** Code review comparing lifecycle checks across prepare_liquidation, liquidation_call/validate_liquidation, and execute_liquidation; noticed execute_liquidation reloads reserves without repeating is_paused/is_active, and the flash-loan asset vector contains only the debt asset.
**Exploitation:** Liquidator pre-stages authorization on a known-unhealthy position, waits for admin to pause the collateral reserve during an incident, then submits execute_liquidation within the 600s window to seize and swap collateral that the pause was meant to freeze.
**Insight:** When a flow is split into prepare/execute across transactions, audit each step for re-validation of mutable config; check whether internal helpers (like flash-loan asset loops) validate only a subset of the assets the outer flow touches.