# The implied value of a public vault can be impaired, liquidity providers can lose funds

Partial lien repayment updates lien.amount with accrued interest before slope recalculation, double-counting interest and corrupting the public vault's slope and implied share value.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: Jeiwan
- Disclosed: 2022-11-07
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/272
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LienToken/PublicVault Solidity contracts (lien repayment and slope accounting)
**Root cause:** In `_payment`, `lien.amount` is set to `_getOwed(lien)` (including accrued interest) before `beforePayment` calls `calculateSlope`, which recomputes interest on the already-inflated amount while `lien.last` is still stale, double-counting interest.
**Steps:**
1. Borrower takes a lien on a public vault and time passes so interest accrues.
2. Borrower calls `_payment` with a partial `paymentAmount`.
3. `lien.amount = _getOwed(lien)` stores amount including accrued interest; `lien.last` not yet updated.
4. `beforePayment` calls `calculateSlope(lienId)`, which calls `_getOwed(lien, end)` adding interest again on the inflated amount over a stale `lien.last` delta.
5. Inflated slope is subtracted from vault `slope` accumulator, then `afterPayment` re-applies a wrong slope.
6. Vault implied value (`totalAssets`) diverges from real liquidity, mispricing ERC4626 LP share conversions.
**How found:** Code reading of `_payment` ordering: noticed `lien.amount` is overwritten with owed value before `beforePayment`/`calculateSlope`, and that `lien.last` is only updated after, so `_getInterest` uses a stale delta on an already-interest-inclusive amount.
**Exploitation:** Borrower repeatedly makes partial repayments to skew the vault's slope accumulator; LPs redeeming shares receive incorrect amounts, with early exiters extracting more than their share and the last LP unable to redeem fully.
**Insight:** When a stored debt amount is refreshed to include accrued interest, any downstream slope/rate recalculation that also applies interest over a stale timestamp will double-count; check ordering of state updates vs. accumulator adjustments in interest-bearing lien/loan contracts.