# Strategist nonce is not checked

AstariaRouter.validateCommitment never checks the strategist nonce, so signed commitments cannot be cancelled and can be reused to borrow repeatedly.

- Payout: Contest reward
- Severity: medium
- Program: Astaria
- Credited: cryptphi
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/59
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AM-18
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:signature-replay

**Target:** AstariaRouter / VaultImplementation.commitToLien commitment validation
**Root cause:** validateCommitment verifies deadline, strategy type and merkle proof but never checks or increments the strategist nonce that is included in the signed commitment, and increaseNonce is never invoked.
**Steps:**
1. Strategist signs a commitment off-chain containing a nonce.
2. Borrower submits commitment to `VaultImplementation.commitToLien`; `_validateCommitment` calls `AstariaRouter.validateCommitment`.
3. validateCommitment checks deadline, strategy validator and merkle proof but not the nonce.
4. Nonce is never incremented via `increaseNonce`, so the same signed commitment remains valid and reusable.
**How found:** Code reading of the signing path (nonce used at signing) versus the validation path (nonce absent) and noticing `increaseNonce` is defined but never called.
**Exploitation:** A borrower reuses a single signed commitment to borrow from the vault multiple times (up to 5 per the report) since the nonce is never consumed; strategist cannot revoke the signature.
**Insight:** When a signed struct includes a nonce, verify the same nonce is consumed/incremented in the validation path; grep for defined-but-uncalled nonce-increment functions as a replay smell.