# `commitToLiens` always reverts

AstariaRouter.commitToLiens always reverts because _returnCollateral tries to transfer an NFT already minted to the borrower, blocking all loan requests.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: bin2chen
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/204
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-5
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:dos

**Target:** AstariaRouter.commitToLiens / CollateralToken onERC721Received
**Root cause:** During _transferAndDepositAsset the NFT is minted to the borrower (from) rather than the operator (AstariaRouter) because operator_ != from_. _returnCollateral then assumes the router owns collateralId and attempts a transfer that reverts.
**Steps:**
1. Borrower calls `commitToLiens()` with an NFT collateral.
2. `_transferAndDepositAsset()` transfers NFT to COLLATERAL_TOKEN; `onERC721Received` mints collateralId to `from` (borrower), not `operator_`.
3. `_returnCollateral()` attempts to transfer collateralId from AstariaRouter to borrower.
4. Transfer reverts since router does not own the token; entire commitToLiens reverts.
**How found:** Code reading of the mint path in CollateralToken.onERC721Received versus the ownership assumption in _returnCollateral; noticed operator_ != from_ causes mint to borrower.
**Insight:** When an ERC721 deposit hook mints a receipt token, check who the mint recipient is (from vs operator) against downstream code that assumes the router/operator holds it; mismatched ownership assumptions cause guaranteed reverts.