# A malicious lien buyer can DoS to cause fund loss/lock

A malicious lien buyer delivers a lien token to an attacker contract whose supportsInterface() reverts, blocking endAuction, liquidate, and makePayment to lock collateral and funds.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: 0xRajeev
- Disclosed: 2022-11-07
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/181
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-17
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Astaria AuctionHouse / LienToken / AstariaRouter lien buyout flow
**Root cause:** buyoutLien delivers a lien token to an arbitrary receiver contract, and the protocol later calls supportsInterface() on that owner in endAuction, liquidate, and _payment without guarding against reverts.
**Steps:**
1. Call `buyoutLien` with a small lien amount and set the receiver to an attacker contract.
2. Attacker contract implements `supportsInterface()` to revert (or arbitrary logic).
3. Protocol invokes `supportsInterface()` on the lien owner in `AuctionHouse.endAuction()` (L195), `AstariaRouter.liquidate()` (L381), and `LienToken._payment()` (L613).
4. Each call reverts, blocking auction settlement, liquidation start, and `makePayment`.
**How found:** Code review of buyoutLien's arbitrary receiver and tracing where the protocol calls supportsInterface() on the lien owner, spotting unguarded external calls in endAuction, liquidate, and _payment.
**Exploitation:** Attacker (even the borrower) buys a minimal lien with token delivered to a malicious contract; the reverting supportsInterface() bricks endAuction, liquidate, and makePayment, locking borrower collateral and other lien holders' funds.
**Insight:** When a protocol lets you choose the receiver of a token/NFT, check every later external call made on that owner (e.g. ERC165 supportsInterface) — a reverting or gas-burning implementation becomes a persistent DoS on shared settlement paths.