# Rewards lost when total supply drops to zero

K2 aToken incentive index advances last_update_timestamp when total supply is zero, permanently discarding emissions for the zero-supply window.

- Payout: Contest reward
- Severity: medium
- Program: K2
- Credited: v12
- Disclosed: 2026-08-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2026-04-k2#m-35
- Library page: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-35
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** aToken incentives reward index (Rust calculation module)
**Root cause:** update_asset_reward_index early-returns on total_supply==0 but still sets last_update_timestamp=current_timestamp, and handle_incentives_action passes post-burn total_supply_scaled instead of pre-action supply, so elapsed emissions are never accrued.
**Steps:**
1. Deposit as sole depositor so total_supply_scaled > 0 and index accrues.
2. Wait so emission_per_second * elapsed_time accumulates.
3. Withdraw entire balance; burn applies first, then handle_incentives_action calls update_asset_reward_index with total_supply_scaled == 0.
4. Observe early return at calculation.rs L61-65 sets last_update_timestamp = current_timestamp without incrementing index.
5. Deposit again; index accrues only from new timestamp, emissions for the zero-supply window are lost.
6. Repeat full withdraw/deposit cycles to waste emission budget.
**How found:** Code review of calculation.rs early-return path combined with tracing handle_incentives_action call ordering (line 311 after burn, line 769 reading post-action total_supply_scaled); compared against Aave V3 reference which passes pre-action supply.
**Exploitation:** Sole depositor repeatedly zeroes total supply via full withdrawal, forcing the index update to skip accrual while advancing the timestamp, permanently burning emission budget that future depositors would have earned.
**Insight:** When auditing reward-index accrual, check whether the supply value passed to the index updater is pre- or post-action; post-burn zero-supply reads combined with timestamp advancement silently burn emissions.