# Public vault strategist reward is not calculated correctly

Astaria PublicVault mints strategist reward shares based on full lien amount instead of actual payment, overpaying strategists on tiny payments.

- Payout: Contest reward
- Severity: medium
- Program: Astaria
- Credited: evan
- Disclosed: 2023-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/435
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** PublicVault/LienToken Solidity contracts (beforePayment, _handleStrategistInterestReward)
**Root cause:** LienToken.beforePayment passes stack.point.amount (remaining lien debt) to _handleStrategistInterestReward instead of the actual amount paid, so reward shares are computed on the full lien value regardless of payment size.
**Steps:**
1. Borrower has an outstanding lien with large stack.point.amount and accrued interestOwed.
2. Strategist (or anyone) makes a tiny payment on behalf of the borrower via LienToken payment path.
3. beforePayment calls _handleStrategistInterestReward with stack.point.amount rather than `amount`.
4. PublicVault mints strategist shares based on the full lien amount, overpaying the strategist.
5. Repeat tiny payments to repeatedly extract excess reward shares.
**How found:** Code review of PublicVault._handleStrategistInterestReward and LienToken.beforePayment; compared sponsor's stated intent (reward on interest actually paid) against the argument passed (stack.point.amount).
**Exploitation:** Strategist makes minimal payments on behalf of a borrower to trigger reward minting computed on the full lien amount, extracting more shares than the interest actually paid warrants; incentivizes maximizing interestOwed.
**Escalation:** Repeated tiny payments compound the overpayment; text notes it can trigger a separate compound-interest issue.
**Insight:** When a reward/fee function takes an 'amount' parameter, trace every caller to confirm it passes the actual paid value, not a stored max/remaining balance field like stack.point.amount.