# Lack of StrategyDetailsParam.vault validation allows the borrower to steal all the funds from the vault

Astaria VaultImplementation.commitToLien never checks strategy.vault matches the lending vault, letting a borrower repay loans with a worthless self-created token and drain vaults.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: Koolex
- Disclosed: 2023-05-22
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/409
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** VaultImplementation.commitToLien / LienToken payment logic
**Root cause:** commitToLien validates all StrategyDetailsParam fields except vault, so the lien records an attacker-controlled vault address; makePayment later reads the repayment asset from that vault instead of the lending vault's asset.
**Steps:**
1. Deploy attacker ERC20 FakeToken and create a private vault with it via ASTARIA_ROUTER.newVault.
2. Deposit NFT into COLLATERAL_TOKEN to get collateral token.
3. Generate valid terms against victim privateVault (WETH) and set `c.lienRequest.strategy.vault = privateVaultOfBorrower`.
4. Call `IVaultImplementation(privateVault).commitToLien(c, address(this))` to borrow 50 WETH.
5. Approve FakeToken to TRANSFER_PROXY and LIEN_TOKEN, then `LIEN_TOKEN.makePayment(collateralId, stack, 0, amount)` repaying with FakeToken.
6. Loop steps 3-5 until victim vault WETH balance is 0.
**How found:** Code review of the commitToLien flow noting every StrategyDetailsParam field was validated except vault, then tracing makePayment to see the asset is read from the strategy vault rather than the lending vault.
**Exploitation:** Borrower repeatedly borrows the vault's real asset while pointing strategy.vault at their own fake-token vault, then repays each lien with worthless FakeToken, netting the full vault balance with zero real debt.
**Escalation:** Repeatable loop drains every vault that accepts the borrower's collateral; strategist ends holding only FakeToken.
**Insight:** When a struct of user-supplied parameters is validated field-by-field, enumerate every field and check which ones are later used as a source of truth (here the repayment asset); a single unvalidated address field can redirect value flow.