# _deleteLienPosition can be called by anyone to delete any lien they wish

Public _deleteLienPosition in Astaria LienToken lacks caller check, letting anyone remove liens from a collateral so borrowers withdraw collateral without repaying lenders.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: TurnipBoy
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/233
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** LienToken.sol lien array / CollateralToken releaseCheck
**Root cause:** _deleteLienPosition is declared public with no access control, so any caller can shift and pop entries from liens[collateralId].
**Steps:**
1. Call `_deleteLienPosition(collateralId, position)` directly as an unprivileged account
2. Function pops the lien from liens[collateralId] array without permission check
3. CollateralToken.sol#releaseCheck now passes since no liens remain
4. Borrower withdraws underlying collateral without repaying lenders
**How found:** Manual code review of LienToken.sol noticing the function visibility is public and lacks a caller check, then tracing that liens array drives releaseCheck.
**Exploitation:** Attacker/borrower calls the public _deleteLienPosition for each lien position on their collateralId, emptying the liens array; releaseCheck then permits withdrawal of the underlying collateral, rugging lenders who never get repaid.
**Insight:** In lending/collateral contracts, audit every function that mutates the lien/debt array for visibility and access control; array membership often gates release logic, so a stray public mutator becomes a full bypass.