# Buyouts of shorter duration liens can lead to the loss of borrower funds

Liens with duration <= minDurationIncrease (14 days) cannot be bought out due to an underflow in _getRemainingInterest, locking borrowers into worse interest rates.

- Payout: Contest reward
- Severity: medium
- Program: Astaria
- Credited: 0xRajeev
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/171
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LienToken.sol buyoutLien / _getRemainingInterest
**Root cause:** buyoutLien requires the new lien duration to exceed the old by minDurationIncrease (14 days), but for liens with duration <= 14 days this forces waiting past expiry, causing an underflow in _getRemainingInterest when computing remaining interest.
**Steps:**
1. Observe strategy lien duration <= minDurationIncrease (14 days).
2. Attempt buyoutLien with a lower-interest lien of the same duration: reverts because duration increase check fails.
3. Wait minDurationIncrease days to satisfy the check: lien is now expired, and _getRemainingInterest underflows.
4. Borrower cannot replace the lien and keeps paying higher interest.
**How found:** Code review of the buyout duration check in AstariaRouter (L489-490) against the underflow in LienToken._getRemainingInterest (L573), reasoning about the boundary case where lien duration equals minDurationIncrease.
**Insight:** When a protocol enforces a minimum delta between old and new values (duration, rate, amount), test the boundary where the current value is already at or below that delta — the required wait can push state past expiry and trigger underflow in downstream interest math.