# Liquidation will fail if value set as liquidationInitialAsk > 2**88-1, causing collateral to be permanently locked

Astaria casts liquidationInitialAsk to uint88 during auction init; values above 2^88-1 revert, permanently locking collateral after loan expiry.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: kaden
- Disclosed: 2023-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/375
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** LienToken.sol auction initialization (liquidationInitialAsk)
**Root cause:** liquidationInitialAsk is stored as uint256 but cast to uint88 via safeCastTo88 when creating the auction; values >= 2^88 revert, so liquidation can never initialize.
**Steps:**
1. Create public vault and lend 50 ether.
2. Commit to lien with liquidationInitialAsk = type(uint256).max.
3. Skip past loan duration (14 days).
4. Call ASTARIA_ROUTER.liquidate(stack, 0) — reverts in safeCastTo88, auction never starts, collateral stuck.
**How found:** Code reading of LienToken.sol line 340: noticed uint256 liquidationInitialAsk is downcast to uint88 in auction creation, then checked SafeCastLib.safeCastTo88 which requires x < 1<<88.
**Exploitation:** Borrower sets an absurdly high liquidationInitialAsk (e.g. type(uint256).max) at lien creation; on default, liquidation reverts, collateral is permanently locked and lender cannot recover funds via auction.
**Insight:** When a value is user-set at creation but downcast to a narrower type only at a later lifecycle stage (liquidation/auction), check the cast bounds — an out-of-range value bricks the only exit path, turning a DoS into permanent fund lock.