# Public vault owner (strategist) can use buyoutLien to indefinitely prevent liquidity providers from withdrawing

Astaria public vault strategist front-runs transferWithdrawReserve with buyoutLien, locking LP funds in the vault and blocking withdrawals indefinitely.

- Payout: Contest reward
- Severity: medium
- Program: Astaria
- Credited: evan
- Disclosed: 2023-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/324
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-18
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** PublicVault / VaultImplementation buyoutLien and transferWithdrawReserve
**Root cause:** buyoutLien does not invoke transferWithdrawReserve() before committing the new lien (unlike commitLien), so available vault funds get consumed by the buyout instead of being routed to the previous epoch's WithdrawProxy.
**Steps:**
1. Create two public vaults controlled by the same strategist; lend 60 ether to each.
2. Commit a 40 ether lien on an NFT from vault1.
3. Warp 3 days; build refinance terms from vault2 for the same lien.
4. LP signals withdraw on vault2; warp to epoch end; call `processEpoch()`.
5. Strategist calls `VaultImplementation(publicVault2).buyoutLien(stack, 0, refinanceTerms)` before `transferWithdrawReserve()`.
6. Call `transferWithdrawReserve()`; observe WithdrawProxy balance < 20 ether despite 60 ether owed.
**How found:** Code reading: noticed commitLien calls transferWithdrawReserve() first but buyoutLien does not, then hypothesized a front-run ordering that starves the WithdrawProxy; confirmed with a Foundry PoC.
**Exploitation:** Strategist front-runs (or races) the permissionless transferWithdrawReserve call with buyoutLien, consuming vault liquidity into a new lien. By only buying out liens from vaults they control (self-lending), they avoid liquidation, so the cycle can repeat each epoch and LPs never receive funds.
**Insight:** When auditing epoch-based vaults, compare every state-changing entrypoint against the one that flushes pending withdrawals; any path that consumes liquidity without first settling the withdraw queue is a griefing vector for the privileged role.