# Vaults don't verify that a strategy's deadline has passed

Astaria VaultImplementation._validateCommitment omits the strategy deadline check present in the router, letting users borrow against expired strategies and harm LPs.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: Ruhum
- Disclosed: 2023-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/122
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-19
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:signature-replay

**Target:** VaultImplementation._validateCommitment / AstariaRouter commitment validation
**Root cause:** Router's _validateCommitment reverts when block.timestamp > strategy.deadline, but VaultImplementation._validateCommitment only checks authority and signature, never the deadline, so expired strategies remain usable when borrowing directly from the vault.
**Steps:**
1. Obtain a signed strategy commitment (v/r/s) from a vault owner/delegate with a deadline that has already passed.
2. Call the vault's commitToLien path directly (not via AstariaRouter) with the expired commitment.
3. Observe VaultImplementation._validateCommitment passes: authority and ecrecover checks succeed, no deadline comparison.
4. Loan is issued using the expired strategy terms.
**How found:** Noticed the router validates strategy.deadline but the vault's own _validateCommitment does not; grepped for 'deadline' and confirmed no other access, showing the check is only enforced on the router path.
**Exploitation:** Borrower submits an expired but validly signed strategy commitment directly to the vault, bypassing the router's deadline check, and takes a loan on stale terms; LPs bear the resulting loss depending on the strategy.
**Insight:** When two entry points share a validation routine, diff them: the router enforced deadline while the vault's parallel _validateCommitment dropped it. Grep for a security field (deadline, nonce) and confirm every path that consumes signed commitments actually reads it.