# LienToken: Lender and liquidator can collude to block auction and seize collateral

Lender transfers LienToken to a USDC/USDT-blocklisted address, making repayments and auction bids revert, letting colluding liquidator claim collateral for free.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: horsefacts
- Disclosed: 2023-05-22
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/607
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained vuln:accounting-error vuln:business-logic vuln:dos

**Target:** LienToken / ClearingHouse / CollateralToken auction settlement
**Root cause:** LienToken is a bearer asset; _getPayee returns ownerOf(lienId), and _payment/_paymentAH push ERC20 transfers to that payee. A payee on a token blocklist makes every repayment and auction bid revert.
**Steps:**
1. Lender issues loan in USDC/USDT and holds LienToken.
2. Lender transfers LienToken to an address on the token blocklist (or otherwise reverting recipient).
3. Borrower calls makePayment -> _payment -> tokenTransferFrom(payer, payee, amount) reverts; loan becomes delinquent.
4. Liquidation auction starts; every bid reverts because settlement pushes payment to blocklisted payee.
5. Liquidator calls CollateralToken#liquidatorNFTClaim -> ClearingHouse#settleLiquidatorNFTClaim -> payDebtViaClearingHouse(address(0), COLLATERAL_ID(), 0, stack), settling for zero payment.
6. Liquidator receives collateral NFT for free; other liens in stack become bad debt.
**How found:** Code reading of _getPayee returning ownerOf(lienId) and _payment/_paymentAH pushing transfers to payee; recognized that ERC20 blocklists (USDC/USDT) make push payments revert, and traced the failed-auction path to settleLiquidatorNFTClaim settling for zero.
**Exploitation:** Lender and liquidator (can be same party) collude: lender offers attractive small loan, transfers lien to blocklisted address, borrower cannot repay, auction bids all revert, liquidator settles claim for zero and takes collateral worth more than the lien.
**Escalation:** Other lenders in the lien stack cannot be repaid and absorb bad debt; borrower loses collateral NFT.
**Insight:** When a protocol pushes ERC20 payments to an owner-controlled address, an owner can grief by pointing the payee at a token-blocklisted or reverting address; trace every push-transfer recipient for attacker control and check whether downstream settlement paths (like zero-payment claim settlement) let a colluder profit from the resulting revert.