# Loans can exceed the maximum potential debt leading to vault insolvency and possible loss of LP funds

Astaria LienToken.createLien checks maxPotentialDebt before adding the new lien, letting borrowers stack liens past the cap and risking vault insolvency.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: 0xRajeev
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/169
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-24
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LienToken.createLien / getTotalDebtForCollateralToken (Solidity vault)
**Root cause:** createLien calls getTotalDebtForCollateralToken before pushing the new lien into liens[collateralId], so the debt check omits the lien being created and the cap can be exceeded.
**Steps:**
1. LPs deposit 100 ETH into public vault
2. Bob borrows 50 ETH against NFT #1 (maxPotentialDebt 50 ETH) -> succeeds
3. Bob borrows another 50 ETH against NFT #2 -> succeeds despite 50 ETH cap
4. Total potential debt now 100 ETH, exceeding the 50 ETH limit by 50 ETH
**How found:** Code reading of createLien: noticed getTotalDebtForCollateralToken iterates liens[collateralId] but the new lien is not yet appended when the check runs.
**Exploitation:** Borrower repeatedly originates liens on separate collateral tokens; each check sees only prior liens, so cumulative debt exceeds strategist's maxPotentialDebt, raising LP risk and enabling vault insolvency.
**Insight:** When a limit check sums an array, verify whether the item being validated is already inserted; off-by-one ordering in state mutation vs. validation is a recurring accounting bug in lending/vault code.