# KickerActions uses wrong check to prevent Kickers from using deposits below LUP for KIckWithDeposit

KickerActions.kickWithDeposit computes LUP with inflated debt, letting a kicker use a below-LUP deposit to kick loans not eligible for liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Ajna
- Credited: Chinmay
- Disclosed: 2023-04-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-ajna-judging/issues/113
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-ajna%3AM-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** Ajna pool KickerActions.kickWithDeposit (Solidity)
**Root cause:** The LUP used for the bucketPrice check is computed via Deposits.getLup(deposits_, poolState_.debt + amountToDebitFromDeposit) on the old deposits state, so for a bucketPrice initially below LUP the inflated debt lowers the computed LUP below bucketPrice, bypassing the guard.
**Steps:**
1. Kicker holds deposits in a bucket with bucketPrice < current LUP.
2. Call `kickWithDeposit` using that bucket's deposit.
3. At KickerActions#207, `kickResult_.lup = Deposits.getLup(deposits_, poolState_.debt + vars.amountToDebitFromDeposit)` is computed with old deposits but inflated debt, lowering LUP.
4. Check at #216 `bucketPrice < kickResult_.lup` passes even though bucketPrice was below the true LUP.
5. Deposit is only removed at #223/#241 after the check, so the kick proceeds against a loan not eligible for liquidation.
**How found:** Code reading of KickerActions: noticed the LUP check used a debt-inflated getLup on the pre-removal deposits state, and reasoned that for a bucketPrice already below LUP the inflated debt lowers the computed LUP, defeating the guard.
**Exploitation:** Attacker deposits below LUP, then calls kickWithDeposit to kick the max-TP loan; larger amountToDebitFromDeposit pushes the intermediate LUP lower, enabling kicking of healthy borrowers. Attacker must post a bond and kicks are queued (only Loans.getMax borrower), making it costly griefing.
**Escalation:** Attacker controls amountToDebitFromDeposit to push intermediate LUP arbitrarily low, potentially kicking borrowers far from underwater; repeatable across users.
**Insight:** When a guard compares a price against a derived value (LUP), verify the derived value is computed on the same state the guard is meant to protect; mixing old deposits with simulated new debt can invert the comparison for the exact edge case the guard targets.