# nlrType type is not signed by strategist, which could allow fraudulent behavior as new types are added

Astaria strategist merkle root omits nlrType, so a borrower could route a signed strategy to a different validator if struct schemas overlap, bypassing checks.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: obront
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/72
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-29
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:signature-replay

**Target:** AstariaRouter lien request validation / strategy validators
**Root cause:** The strategist signs the merkle root, nonce, and deadline but not the nlrType selector, so the validator used to interpret a signed leaf is not bound to the signed data.
**Steps:**
1. Strategist signs merkle root containing leaves for Type A and Type B strategies with overlapping Details struct schemas.
2. Borrower crafts lienDetails satisfying Type A requirements but not Type B.
3. Borrower submits lien request with `nlrType = Type A` pointing validation at the wrong validator.
4. Validator parses the signed leaf under Type A schema, bypassing Type B's intended checks.
**How found:** Code review of AstariaRouter's signed data vs. the nlrType parameter; noticed nlrType is not included in the strategist-signed payload and reasoned about future struct schema collisions across validators.
**Exploitation:** Requires future addition of a validator whose Details struct schema overlaps another's with differing semantics; borrower then submits a lien with mismatched nlrType to have the signed leaf validated under the wrong schema, accepting a fraudulent lien.
**Insight:** When a signed payload selects a parser/validator via an unsigned type tag, the tag itself must be bound into the signature; otherwise future schema overlap turns into a type-confusion bypass.