# Payments and liquidations of multiple liens will revert and can be exploited, causing payer fund loss

Astaria's liens array shrinks on full repayment, shifting indices so looped payments/liquidations revert or pay the wrong lien, locking collateral and enabling forced payment to attacker's lien.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: 0xRajeev
- Disclosed: 2022-11-07
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/172
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-23
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** LienToken.sol lien array payment/liquidation loop
**Root cause:** Liens are referenced by array position, but fully repaying a lien deletes it from the array, shifting indices of remaining liens. Loops iterating by index then hit out-of-bounds or target the wrong lien.
**Steps:**
1. Observe liens array e.g. `[1, 5, 3]` where attacker holds lien 3 and borrower intends to pay lien 5.
2. Attacker (junior holder of 3) buys out senior lien 1 and front-runs borrower's payment for 5 by repaying lien 1.
3. Repaying lien 1 deletes it, shortening array to `[5, 3]`.
4. Borrower's payment loop now indexes position that maps to lien 3, paying attacker's lien instead of lien 5.
5. Alternatively, looped payment/liquidation over multiple liens reverts with index out-of-bounds, locking the collateral NFT.
**How found:** Code reading of LienToken.sol: noticed liens are deleted from the array on full repayment while payments/liquidations reference liens by array index, implying index instability.
**Exploitation:** Attacker acquires a lien position and front-runs the borrower's multi-lien payment by fully repaying another lien, shrinking the array so the borrower's indexed payment lands on the attacker's lien, forcing payment to attacker. Also DoSes liquidation loops, locking collateral.
**Escalation:** Sandwiching a repayment to shift indices converts a DoS into forced misdirected payment to attacker's lien.
**Insight:** When an array is mutated (deletion) during iteration or referenced by stored index across transactions, check whether indices are stable; attacker-controlled deletions can shift indices to redirect value or cause out-of-bounds reverts.