# Auction bid that partially pays back an expired lien will revert

Partial auction bids on an expired Astaria lien revert because lien.last is set to block.timestamp, making end - lien.last underflow in calculateSlope.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: 0xRajeev
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/179
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-19
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** LienToken auction/payment logic (Solidity)
**Root cause:** lien.last is updated to block.timestamp even for expired liens during partial payments, so end - lien.last underflows when computing the slope in calculateSlope.
**Steps:**
1. Lien expires: block.timestamp > lien.start + lien.duration.
2. Auction bid partially pays the lien via LienToken._payment, hitting the partial-payment branch that sets lien.last = block.timestamp.
3. Flow calls IPublicVault(lienOwner).afterPayment(lienId) then slope += LIEN_TOKEN().calculateSlope(lienId).
4. calculateSlope computes (owedAtEnd - lien.amount).mulDivDown(1, end - lien.last); since lien.last > end, subtraction underflows and reverts.
**How found:** Code review of LienToken payment/slope logic; noticed lien.last is set to block.timestamp in multiple places including for expired liens, then traced the subtraction end - lien.last in calculateSlope.
**Exploitation:** Not an attacker-driven exploit; partial auction bids on expired liens revert, DoSing partial bids and reducing auction efficiency, causing LP fund loss.
**Insight:** When a timestamp field is reused as both 'last payment time' and 'lien end reference', check every subtraction involving it for underflow after expiry; partial-payment branches that refresh timestamps can break slope/interest math.