# Denial-of-Service in the liquidation flow results in the collateral NTF will be stuck in the contract.

Extreme loanToValue in a signed offer makes shareMatched round to 0, so price() divides by zero and liquidation reverts, freezing collateral NFT.

- Payout: Contest reward
- Severity: medium
- Program: Kairos
- Credited: Inspex
- Disclosed: 2023-02-28
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-kairos-judging/issues/76
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-kairos%3AM-1
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** BorrowHandlers/AuctionFacet price() liquidation math
**Root cause:** shareMatched can round to 0 (or estimatedValue overflow) when loanToValue is extremely large relative to borrow amount; price() then divides by zero or overflows, reverting liquidation.
**Steps:**
1. Craft offer with loanToValue=1e61 and borrow amount=1e40 so shareMatched rounds to 0
2. Borrower calls `kairos.borrow(borrowArgs)` with signed offer; NFT collateral locked in contract
3. Warp past duration and call `kairos.price(loanId)` / liquidation
4. price() divides by shareMatched=0 -> `Division or modulo by 0` revert; liquidation impossible
**How found:** Code reading of BorrowHandlers shareMatched computation and AuctionFacet price() math; hypothesized rounding to zero and overflow with extreme loanToValue, confirmed with Foundry PoC.
**Exploitation:** Lender signs an offer with absurdly high loanToValue; borrower takes loan, collateral NFT is escrowed. Once share rounds to zero, every liquidation path reverts, so the NFT is permanently stuck and debt cannot be cleared.
**Insight:** In share-based lending math, check whether share = amount*LTV/price can round to 0 or overflow for extreme but valid signed-offer parameters; any division by share in liquidation becomes a permanent DoS on collateral.