# Buying out corrupts the slope of a vault, reducing rewards of LPs

Astaria buyoutLien creates a new lien without increasing the vault's slope, so the refinanced lien accrues no interest and LPs lose rewards.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: Jeiwan
- Disclosed: 2023-05-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/477
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PublicVault / LienToken buyout refinancing flow
**Root cause:** buyoutLien burns the old lien (decreasing vault slope) and creates a new lien, but the new lien's slope is never added back to the vault's total slope, leaving it at zero.
**Steps:**
1. Create a PublicVault with 14-day epoch and lend 50 ether.
2. Commit to a lien of 10 ether against an NFT; assert vault slope equals lien slope.
3. Warp 3 days, generate refinance terms, call `VaultImplementation(publicVault).buyoutLien(stack, 0, refinanceTerms)`.
4. Observe `PublicVault.getSlope()` returns 0 while `LIEN_TOKEN.calculateSlope(stack[0])` is nonzero (expected 481511019363).
**How found:** Code review of the buyout path: noticed slope is decremented on lien burn (LienToken.sol#L189) but not incremented on new lien creation (LienToken.sol#L127), unlike the normal commitment path in PublicVault.sol#L449.
**Exploitation:** Borrower repeatedly buys out their own lien to reset the vault slope to zero, paying no interest on the refinanced lien while LPs earn nothing on their capital.
**Insight:** In refinancing/buyout flows, audit that every accounting accumulator (slope, debt, rate) is symmetrically decremented for the old position and incremented for the new one; the create path often differs from the standard open path.