# A malicious private vault can preempt the creation of a public vault by transferring lien tokens to the public vault, thereby preventing the borrower from repaying all loans

Malicious private vault pre-transfers lien tokens to a predicted public vault address, so borrower repayment overflows and collateral gets liquidated.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: cccz
- Disclosed: 2023-05-22
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/246
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-14
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** LienToken / AstariaRouter public vault creation
**Root cause:** transferFrom blocks transfers to existing public vaults via _isPublicVault, but a public vault's address is predictable via CREATE before deployment, so liens can be sent to the not-yet-created vault whose liensOpenForEpoch is 0.
**Steps:**
1. Private vault A lends 1 ETH to borrower against 2 ETH NFT collateral, minting a lien token.
2. Attacker predicts public vault B address (CREATE from alice + nonce) and calls `LienToken.transferFrom(attacker, predictedB, lienId)` before B exists; `_isPublicVault` returns false so transfer succeeds.
3. Attacker calls `AstariaRouter.newPublicVault` to deploy vault B at the predicted address with liensOpenForEpoch = 0.
4. Borrower calls `LienToken.makePayment`; `decreaseEpochLienCount` underflows because count is 0, reverting repayment.
5. Loan expires unpaid; collateral NFT is auctioned/liquidated.
**How found:** Code review of transferFrom's public-vault recipient guard, noticing the guard relies on runtime state (_isPublicVault) that is false for a not-yet-deployed address, combined with knowledge that ClonesWithImmutableArgs uses CREATE giving predictable addresses.
**Exploitation:** Attacker with a private vault positions a lien token at a precomputed public vault address, then deploys the vault so the borrower's repayment path reverts on underflow, forcing liquidation of the borrower's collateral.
**Insight:** Guards that check whether an address is a privileged contract fail for counterfactually-deployed addresses; any CREATE-based clone address is predictable, so validate code existence or track expected deployments rather than trusting runtime type checks.