# When Public Vault A buys out Public Vault B's lien tokens, it does not increase Public Vault A's liensOpenForEpoch, which would result in the lien tokens not being repaid

Public Vault A buying out Vault B's lien via buyoutLien never increments A's liensOpenForEpoch, so later repayment underflows decreaseEpochLienCount, blocking repayment and liquidation.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: cccz
- Disclosed: 2023-05-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/222
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-16
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** PublicVault / LienToken buyout and payment accounting
**Root cause:** LienToken.buyoutLien calls handleBuyoutLien on the seller public vault (decrementing its liensOpenForEpoch) but never increments the buyer public vault's liensOpenForEpoch when it receives the new lien token.
**Steps:**
1. Public Vault B holds a lien token; B.liensOpenForEpoch == 1.
2. Public Vault A calls buyoutLien(stack, position, incomingTerms); LienToken burns B's lien and mints a new lien to A.
3. handleBuyoutLien on B decrements B.liensOpenForEpoch to 0; A.liensOpenForEpoch remains 0.
4. Borrower calls repay; _payment invokes A.decreaseEpochLienCount -> `A.liensOpenForEpoch--` underflows in unchecked block, reverting.
5. Liquidation path updateVaultAfterLiquidation also reverts in _decreaseEpochLienCount, so collateral cannot be auctioned.
**How found:** Code-reading of buyoutLien flow: noticed handleBuyoutLien is invoked only on the payee (seller) vault, and traced that the buyer vault's liensOpenForEpoch is never incremented, then followed the repayment/liquidation paths to the unchecked decrement.
**Exploitation:** Any public vault can trigger by buying out another public vault's lien; the resulting underflow permanently blocks borrower repayment and liquidation, locking collateral and harming vault depositors.
**Insight:** When a token/lien migrates between two instances of the same accounting contract, audit both sides of the transfer: every counter decremented on the source must be incremented on the destination, especially counters later decremented inside unchecked blocks.