# Adversary can grief kicker by frontrunning kickAuction call with a large amount of loan

Frontrunning kickAuction with a large loan inflates average pool debt, lowering MOMP and NP so kickers get penalized instead of rewarded.

- Payout: Contest reward
- Severity: medium
- Program: Ajna
- Credited: koxuan
- Disclosed: 2022-12-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-ajna-judging/issues/111
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-10
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** Auctions.sol _kick MOMP calculation in lending pool
**Root cause:** MOMP is computed from pool debt divided by number of loans (average debt size); a large new loan raises average debt, lowering MOMP and thus the neutral price used to reward/penalize kickers.
**Steps:**
1. Observe `_kick` computes `momp = _priceAt(Deposits.findIndexOfSum(deposits_, Maths.wdiv(poolState_.debt, noOfLoans * 1e18)))`.
2. Compute deposits above buckets and total pool debt to determine loan size needed to push MOMP down.
3. Frontrun victim's `kickAuction` tx by taking a large loan (paying origination fee) to inflate average debt.
4. Victim's kick executes with lowered MOMP/NP, making reward unlikely and penalty likely.
**How found:** Code reading of `_kick` MOMP formula and whitepaper NP derivation; noticed average debt size (debt/numLoans) is manipulable by a single large borrow.
**Exploitation:** Attacker borrows a large amount just before the kicker's kickAuction lands, shifting average loan size and lowering MOMP/NP; kicker's bond is then exposed to penalty rather than bonus. Attacker pays origination fee (~one week interest or 5bps).
**Escalation:** Borrowers generally incentivized to keep pushing MOMP/NP down, potentially spiraling over-borrowing and bad debt.
**Insight:** When a price/oracle is derived from pool-wide averages (debt/numLoans), a single large position can shift it; check whether liquidation incentive parameters depend on manipulable aggregates rather than per-loan snapshots.