# Improper validations in Clearinghouse, possible to lock collateral NFT in contract

ClearingHouse.safeTransferFrom trusts caller-supplied paymentToken from identifier, letting anyone settle a live auction with a worthless ERC20 and permanently lock the collateral NFT.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: Lirios
- Disclosed: 2023-05-22
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/521
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-03
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ClearingHouse.safeTransferFrom / Seaport auction settlement
**Root cause:** ClearingHouse decodes paymentToken from the caller-supplied identifier metadata instead of the auction's stored settlementToken, and LienToken.payDebtViaClearingHouse never verifies the token matches the lien's settlement token.
**Steps:**
1. Borrow via requestLienPosition; let the loan expire past stack.point.end.
2. Liquidator calls AstariaRouter.liquidate, starting a Seaport dutch auction and setting CollateralToken state to auction.
3. Attacker deploys a worthless ERC20 and mints a balance to the ClearingHouse clone.
4. Attacker calls `CH.safeTransferFrom(address(0), bidder, uint256(uint160(address(worthlessToken))), 0, "")` directly.
5. ClearingHouse._execute decodes paymentToken from identifier, sees balance >= currentOfferPrice, calls LienToken.payDebtViaClearingHouse with the fake token, then CollateralToken.settleAuction burns the collateral token and deletes idToUnderlying and collateralIdToAuction.
6. NFT remains in ClearingHouse but ownerOf reverts; releaseToAddress, flashAction, liquidatorNFTClaim and new liens all fail.
**How found:** Code reading of the liquidation flow: noticed _generateValidOrderParameters stores settlementToken as identifierOrCriteria, and ClearingHouse.safeTransferFrom is externally callable and blindly decodes paymentToken from that identifier without checking it against the auction's settlement token.
**Exploitation:** Attacker needs no capital beyond a worthless ERC20 minted to the ClearingHouse. By calling safeTransferFrom directly with the fake token address encoded as identifier, they trigger the full settlement path: debt marked paid, collateral token burned, auction data deleted, while the actual NFT stays stuck in the ClearingHouse. This cancels the auction and permanently locks the borrower's collateral, and can be repeated to block all liquidations.
**Escalation:** Repeatable across any auction to grief all liquidations protocol-wide, denying liquidators and trapping borrower collateral.
**Insight:** When a contract is invoked as a Seaport/ERC721 receiver callback, any caller can supply arbitrary metadata; always cross-check decoded parameters against stored auction state rather than trusting the callback payload, and verify token identity in downstream debt-settlement functions.