# Malicious refinancing attack could lead to suboptimal NFT liquidation

Permissionless refinancing lets an attacker reset liquidationInitialAsk near zero just before liquidation, so the borrower's NFT sells far below fair value.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: gtocoder
- Disclosed: 2023-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/430
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** AstariaRouter refinance/liquidation logic (Solidity)
**Root cause:** Refinance validation checks loan duration, rate and debt but ignores liquidationInitialAsk, so a new lien can lower the auction starting price arbitrarily. Refinancing is permissionless and allowed close to liquidation.
**Steps:**
1. Borrower takes loan of 3 ETH against NFT with liquidationInitialAsk = 100 ETH.
2. Borrower fails to repay; liquidation approaches.
3. Attacker calls refinance (permissionless) paying off the 3 ETH debt plus minimal fee, setting liquidationInitialAsk near 0.
4. Liquidation triggers; NFT auction starts at near-zero ask.
5. Attacker bids low and acquires the NFT cheaply.
**How found:** Auditor read the refinance validation in AstariaRouter.sol#L684 and noticed liquidationInitialAsk was absent from the checked parameters, then reasoned that permissionless refinancing plus proximity to liquidation removes the borrower's ability to react.
**Exploitation:** Attacker monitors loans nearing liquidation, refinances the lien with a near-zero liquidationInitialAsk, then wins the resulting auction at a fraction of fair value, capturing the spread between low purchase price and NFT market value.
**Insight:** When a permissionless 'improvement' path (refinance/buyout) validates only some loan parameters, enumerate every parameter the borrower relied on at origination and check which ones a third party can silently worsen right before a value-extraction event.