# Anyone can wipe complete state of any collateral at any point

Missing auction check in ClearingHouse settlement lets anyone call safeTransferFrom to wipe liens and burn any borrower's collateral token for zero payment.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: obront
- Disclosed: 2023-05-22
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/287
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-13
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ClearingHouse ERC1155 settlement / CollateralToken / LienToken
**Root cause:** settleAuction() uses && instead of || when checking auction state, so a zeroed auctionStack passes the payment check and settlement proceeds with zero payment.
**Steps:**
1. Call `ClearingHouse.safeTransferFrom(offerer, buyer, paymentToken, 0, data)` for a victim collateralId with no active auction.
2. `_execute` reads zeroed auctionStack; `_locateCurrentAmount` returns 0 since startAmount==endAmount==0.
3. Payment check passes with 0 tokens received.
4. `LienToken#payDebtViaClearingHouse()` zeros lien storage and deletes collateralStateHash.
5. `Collateral#settleAuction()` deletes idToUnderlying and collateralIdToAuction and burns the collateral token.
6. Borrower permanently loses claim on underlying collateral.
**How found:** Code review of settlement flow: noticed no check that safeTransferFrom occurs post-auction, then traced that zeroed auctionStack yields zero payment and that the settleAuction guard uses && instead of ||, making the second condition false when ClearingHouse owns the NFT.
**Exploitation:** Attacker needs no capital: calls safeTransferFrom on any deposited collateral with amount 0. Zeroed auctionStack makes required payment 0, so settlement executes, burning liens and collateral token and deleting mappings.
**Insight:** When a settlement/cleanup path zeroes state, verify every guard uses the correct boolean operator and that 'no auction' state cannot satisfy payment checks; zeroed structs often make amount calculations return 0 and bypass payment validation.