# Lien buyout with new terms does not update the slope of public vaults

Astaria's buyoutLien changes lien terms but never updates the public vault's slope, causing liquidation reverts and mispriced vault shares.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: 0xRajeev
- Disclosed: 2022-11-07
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/180
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-18
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:dos vuln:liquidation

**Target:** VaultImplementation.buyoutLien / PublicVault slope accounting
**Root cause:** buyoutLien updates lien terms (last, start, rate, duration) without subtracting the old slope and adding the new slope to PublicVault.slope, leaving the vault's slope stale.
**Steps:**
1. Call `VaultImplementation.buyoutLien` on a lien backed by a public vault, changing its terms.
2. Observe `PublicVault.slope` is not adjusted for the new lien slope.
3. Trigger liquidation: `AstariaRouter` adjusts vault slope by lien slope, then `PublicVault.updateVaultAfterLiquidation` reverts on slope underflow for a single lien.
4. Alternatively read `PublicVault.totalAssets` (line 412) which uses stale slope, yielding wrong implied value and incorrect share pricing.
**How found:** Code review of buyoutLien against slope accounting: noticed lien terms change on buyout but PublicVault.slope is never recomputed, then traced slope usage in liquidation and totalAssets.
**Exploitation:** No direct theft described; stale slope causes liquidation reverts (DoS on liquidations) and mispriced vault shares (undervalue/overvalue), potentially leading to vault insolvency.
**Insight:** When a mutable loan/lien's rate or duration changes, every derived accumulator (slope, interest index) must be decremented with old terms and re-incremented with new ones; grep for slope/rate updates on any term-mutating path.