# _buyoutLien() does not properly validate the liquidationInitialAsk

Astaria _buyoutLien validates liquidationInitialAsk against the old lien stack instead of the new stack, allowing buyouts with insufficient bid coverage of debt.

- Payout: Contest reward
- Severity: medium
- Program: Astaria
- Credited: bin2chen
- Disclosed: 2023-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/587
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LienToken _buyoutLien buyout logic
**Root cause:** The potentialDebt vs liquidationInitialAsk check iterates params.encumber.stack (the old stack) before the new lien is substituted, so the new lien's liquidationInitialAsk is never validated against accumulated debt.
**Steps:**
1. Call _buyoutLien with a params.encumber.stack whose entries have a high liquidationInitialAsk so the loop check passes.
2. The new lien (with a low liquidationInitialAsk) is only inserted afterward via _replaceStackAtPositionWithNewLien.
3. Resulting newStack has debt exceeding the new lien's liquidationInitialAsk, so bids cannot cover debt.
**How found:** Code reading of _buyoutLien: noticed the validation loop uses params.encumber.stack (old stack) while the new lien is only substituted later, so the check never sees the new lien's liquidationInitialAsk.
**Exploitation:** Attacker submits a buyout where the old stack's liquidationInitialAsk satisfies the check while the replacement lien's ask is too low, leaving the position under-collateralized for liquidation bids.
**Insight:** In buyout/refinance flows, verify invariants against the post-mutation stack, not the input stack; check ordering of validation vs. replacement.