# Malicious strategist could deny borrowers from repaying loan and force liquidation by setting a extremely high vault fee

Malicious strategist sets extreme vault fee, causing SafeCastTo88 revert on repayment, blocking borrowers and forcing NFT collateral liquidation.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: peakbolt
- Disclosed: 2023-05-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/295
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos vuln:liquidation

**Target:** PublicVault vaultFee / loan repayment path
**Root cause:** vaultFee is unvalidated at vault creation; on repayment, convertToShares(fee) exceeds uint88 and safeCastTo88() reverts, so repayment is impossible.
**Steps:**
1. Create public vault via ASTARIA_ROUTER.newPublicVault with vaultFee=1e13 (no range check).
2. Refinance a victim's outstanding loan into the high-fee vault (anyone can refinance; only interest rate/duration checked, not vault fee).
3. Borrower calls repayLoan; _handleStrategistInterestReward computes `uint88 feeInShares = convertToShares(fee).safeCastTo88();` which reverts.
4. Loan expires unpaid, triggering liquidation of borrower's NFT collateral.
**How found:** Code reading of PublicVault repayment path spotted unvalidated vaultFee and the safeCastTo88 conversion; reproduced by editing test helper vaultFee to 1e13 and running testBasicPublicVaultLoan.
**Exploitation:** Strategist creates high-fee vault, self-lends to fund refinancing of target loans (especially near expiry) into that vault without borrower consent; repayment reverts, loan expires, collateral liquidated; strategist may bid on NFT with lowered liquidationInitialAsk.
**Escalation:** Targeting loans near expiry limits borrower reaction time; refinance with lower liquidationInitialAsk to cheaply acquire collateral at liquidation.
**Insight:** When a config value is only consumed on a later user action (repayment), check whether an attacker-controllable party can set it after the victim is committed—here via permissionless refinancing that ignores fee parameters.