# Vault may be drained after a liquidated NFT was claimed by the liquidator

Liquidator claiming an unbidded NFT skips auction settlement, leaving the CollateralToken alive so the borrower re-borrows against collateral they no longer own, draining the vault.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: Jeiwan
- Disclosed: 2023-05-22
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/480
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** ClearingHouse.settleLiquidatorNFTClaim / CollateralToken.liquidatorNFTClaim
**Root cause:** liquidatorNFTClaim calls settleLiquidatorNFTClaim which burns the lien and releases the NFT but never calls settleAuction, so the CollateralToken, its underlying-token link, and its auction link persist.
**Steps:**
1. Alice commits an NFT as collateral and borrows 100 ETH from a public vault.
2. Loan expires; Bob liquidates via ASTARIA_ROUTER.liquidate.
3. Auction runs with no bids; after expiry Bob calls COLLATERAL_TOKEN.liquidatorNFTClaim(listedOrder).
4. NFT transfers to Bob, but COLLATERAL_TOKEN.ownerOf(collateralId) still returns Alice and the auction mapping is not cleared.
5. Alice calls _commitToLien again on the same tokenId/collateralId and borrows the vault's remaining 50 ETH with no collateral.
6. Vault balance reaches 0; Alice keeps 150 ETH.
**How found:** Code review of the liquidator claim path: noticed settleLiquidatorNFTClaim burns the lien but omits settleAuction, then traced the three cleanup steps (burn CollateralToken, clear underlying link, clear auction link) that settleAuction performs and confirmed none run.
**Exploitation:** Attacker (borrower) waits for their own loan to be liquidated with zero auction bids, lets the liquidator claim the NFT, then reuses the still-live CollateralToken to open a fresh lien against the same collateralId and withdraws the vault's remaining liquidity.
**Escalation:** Repeatable per vault/epoch: each unbidded liquidation leaves a reusable CollateralToken, allowing successive loans until the vault is emptied.
**Insight:** When a protocol has parallel 'settle' and 'claim' paths, diff the state cleanup each performs; a claim path that skips auction settlement leaves the collateral token (and its lien eligibility) alive, enabling re-borrowing against already-released collateral.