# Public vaults can become insolvent because of missing `yIntercept` update

Astaria PublicVault's beforePayment() fails to deduct yIntercept on lien payments, inflating vault asset accounting and causing insolvency.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: 0xRajeev
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/197
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** PublicVault.sol beforePayment() accounting hook
**Root cause:** beforePayment() omits subtracting the paid amount from yIntercept, so the vault's virtual-asset total (slope*dt + yIntercept) stays inflated after liens are repaid.
**Steps:**
1. Read PublicVault.sol#L427-L442 beforePayment() and note yIntercept is not decremented by `amount`.
2. Observe totalAssets = slope.mulDivDown(delta_t,1) + yIntercept uses stale yIntercept.
3. Deposit into public vault, take a lien, repay it, and observe totalAssets remains inflated versus actual assets.
4. Run provided PoC gist to demonstrate inflated vault valuation leading to insolvency.
**How found:** Code-reading of the beforePayment() Natspec, which explicitly states the payment amount should be deducted from yIntercept, versus the implementation that omits it.
**Exploitation:** Attacker exploits inflated totalAssets accounting to misprice vault shares/withdrawals, extracting more than entitled and rendering the vault insolvent.
**Insight:** When a hook's Natspec documents an accounting mutation, diff the doc against the code: missing state updates in payment/liquidation hooks silently inflate virtual-asset totals and break share pricing.