# At the second time the nft is used as collateral to take a loan, the debt repayment via auction fund can be failed when liquidation 

Stale ERC20 allowance in a reused per-collateral ClearingHouse clone makes safeApprove revert on second liquidation, blocking debt repayment from auction funds.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: KIntern\_NA
- Disclosed: 2023-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/379
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** ClearingHouse._execute() ERC20 approval to TRANSFER_PROXY
**Root cause:** One ClearingHouse clone is reused per collateralId across loans; safeApprove reverts when setting a non-zero allowance over an existing non-zero allowance left from a prior liquidation.
**Steps:**
1. Transfer NFT x to CollateralToken, take loan, get liquidated; ClearingHouse._execute() approves payment-liquidatorPayment to TRANSFER_PROXY leaving allowance > 0.
2. Transfer same NFT x to CollateralToken again, take another loan, trigger liquidation.
3. Call ClearingHouse._execute() again; `ERC20(paymentToken).safeApprove(TRANSFER_PROXY, payment - liquidatorPayment)` reverts because prior allowance is non-zero.
**How found:** Noticed ClearingHouse clones are created once per collateralId and never reset, then reasoned about stale state persisting across loan lifecycles; inspected _execute's safeApprove and its non-zero-to-non-zero revert behavior.
**Exploitation:** Attacker/liquidator relies on the second liquidation's auction proceeds to repay debt; the revert in _execute blocks the repayment path, leaving debt unsettled.
**Insight:** When a contract is cloned/cached per asset and reused across lifecycles, audit every persistent storage slot (especially ERC20 allowances) for stale state that changes behavior on the second use.