# Purchaser of a lien token may not receive payments

buyoutLien() fails to reset lienData[lienId].payee, so a seller who set a custom payee keeps receiving payments after the lien is bought out.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: 0xRajeev
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/193
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** LienToken.sol buyoutLien/setPayee/getPayee
**Root cause:** buyoutLien() transfers lien ownership but does not reset lienData[lienId].payee; getPayee() returns the stored payee instead of the new owner when it is non-zero.
**Steps:**
1. Seller calls `setPayee(lienId, sellerAddr)` on their lien.
2. Buyer calls `buyoutLien(lienId)` paying the buyout price; ownership transfers to buyer.
3. `lienData[lienId].payee` remains sellerAddr.
4. Borrower payments via `_payment()` resolve payee through `getPayee()`, which returns sellerAddr, not the new owner.
5. Buyer receives nothing until they manually call `setPayee(lienId, buyerAddr)`.
**How found:** Code review of buyoutLien() vs getPayee()/setPayee(): noticed ownership transfer does not touch the payee field, and getPayee() only falls back to owner when payee is zero.
**Exploitation:** Malicious lien seller sets payee to their own address via setPayee(), then sells the lien through buyoutLien(); future borrower payments continue routing to the seller while the buyer holds the token, until the buyer notices and resets the payee.
**Insight:** When a token transfer changes ownership, audit every auxiliary mapping keyed by tokenId (payee, approvals, roles) for stale state that overrides owner-derived defaults; a non-zero override field silently shadows the new owner.