# Attacker can take loan for Victim

Astaria's _validateCommitment authority check short-circuits when receiver equals the collateral owner, letting any attacker originate a loan against a victim's NFT and stick them with fees.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: csanuragjain
- Disclosed: 2023-05-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/19
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-21
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Astaria VaultImplementation commitToLien / _validateCommitment
**Root cause:** The authority check uses a single AND-chain of negated conditions, so setting receiver = holder makes `receiver != holder` false and the whole revert is skipped, even though msg.sender is neither holder, operator, nor approved-for-all.
**Steps:**
1. Pick victim collateral: collateralId = tokenContract.computeId(tokenId), CT.ownerOf(id) = User Y, CT.getApproved(id) = User Z, isApprovedForAll(Y, X) = false.
2. Call commitToLien with params where receiver = User Y (the holder) and msg.sender = attacker X.
3. _requestLienAndIssuePayout calls _validateCommitment; the if-condition `msg.sender != holder && receiver != holder && receiver != operator && !isApprovedForAll(holder, msg.sender)` evaluates false because receiver == holder.
4. Signature check passes (valid vault/delegate signature), loan is issued against victim's collateral and fees accrue to the victim.
**How found:** Code reading of _validateCommitment: noticed the authority check is a single AND-chain of negations, so any one false term (here receiver == holder) bypasses the revert entirely.
**Exploitation:** Attacker submits a commitment with receiver set to the collateral owner; the short-circuited authority check lets the loan originate without owner consent, imposing an unwanted loan and associated fees on the victim.
**Insight:** When an authorization guard is written as one AND-chain of negated conditions, look for any single term an attacker controls (like receiver) that can be made false to skip the whole revert; split caller-authority and receiver-authority into separate checks.