# Adversary can game the liquidation flow by transfering a dust amount of the payment token to ClearingHouse contract to settle the auction if no one buy the auctioned NFT

ClearingHouse.safeTransferFrom lacks access control, so anyone can dust the payment token to the contract and settle a Dutch auction at its floor price, blocking the liquidator.

- Payout: Contest reward
- Severity: medium
- Program: Astaria
- Credited: ladboy233
- Disclosed: 2023-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/112
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-30
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ClearingHouse.sol safeTransferFrom / _execute auction settlement
**Root cause:** safeTransferFrom is public with no caller check (should be Seaport/conduit only) and settlement only requires the contract's payment-token balance to exceed the current Dutch-auction price, which decays to 1000 wei.
**Steps:**
1. Wait until the Dutch auction price decays low (e.g. ~10000 wei) with no buyer.
2. Transfer a dust amount (e.g. 10001 wei) of the ERC20 payment token directly to the ClearingHouse contract.
3. Call `ClearingHouse.safeTransferFrom(from, to, identifier, amount, data)` with encodedMetaData carrying the payment token address.
4. `_execute` reads `payment = ERC20(paymentToken).balanceOf(address(this))`, passes `require(payment >= currentOfferPrice)`, pays liquidator fee, calls `payDebtViaClearingHouse`, and `settleAuction(collateralId)`.
**How found:** Code reading of ClearingHouse.safeTransferFrom revealed no access control; tracing _execute showed settlement only checks the contract's token balance against the decaying Dutch-auction price, so an external dust transfer satisfies it.
**Exploitation:** Attacker preconditions: no buyer for the auctioned NFT and price decayed near the 1000 wei floor. Attacker dusts the payment token to ClearingHouse then calls the permissionless safeTransferFrom, forcing settlement at the floor price. The tiny payment does not cover outstanding debt, so the liquidator is blocked from claiming the NFT and lenders absorb the loss.
**Insight:** When a settlement function trusts `balanceOf(address(this))` as proof of payment, any external transfer can satisfy it; check whether the caller is the intended marketplace/conduit and whether the NFT actually left the contract.