# Adversary can utilize a large number of their own loans to cheat other lenders out of interest

Kairos splits minimum interest evenly across loan provisions, so a borrower inflating provisions with self-loans dilutes legitimate lenders' yield to ~1/9th.

- Payout: Contest reward
- Severity: medium
- Program: Kairos
- Credited: 0x52
- Disclosed: 2023-02-28
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-kairos-judging/issues/24
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-kairos%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** lending protocol interest distribution (ClaimFacet.sendInterests)
**Root cause:** When total interest equals minInterestsToRepay, each provision receives an unweighted equal share (interests / loan.nbOfPositions) instead of a share proportional to provision.amount, so many small self-provisions capture most of the interest.
**Steps:**
1. Attacker finds a legitimate offer to lend 820 USDC at 10% APR and claims it.
2. Attacker creates their own offer and borrows 20 USDC from it 9 times, producing 10 provisions total (9 tiny self-provisions + 1 large legitimate provision).
3. After 1 year, total interest owed is 100 USDC, which equals the summed minimum interest (10 USDC x 10 provisions).
4. Attacker repays; sendInterests takes the min-interest branch and pays each provision interests/nbOfPositions = 10 USDC.
5. 90 USDC goes to attacker's own provisions, 10 USDC to the legitimate lender (~1.2% APR vs 10% intended).
**How found:** Code review of sendInterests: noticed the min-interest branch divides interest equally by nbOfPositions rather than weighting by provision.amount, then constructed a numeric example showing dilution.
**Exploitation:** Borrower self-funds many minimal provisions alongside one victim provision, then repays at the point where total interest equals the summed minimum, triggering the equal-split branch and routing most interest to their own provisions.
**Insight:** When a protocol has a 'minimum fee/interest' fallback branch, check whether that branch distributes proportionally or equally across positions; equal splits let an attacker pad position count with dust-sized self-positions to capture the fallback payout.