# _payment() function transfers full paymentAmount, overpaying first liens

LienToken._payment() transfers the full paymentAmount to the first lien owner instead of capping at the amount owed, overpaying and losing borrower funds.

- Payout: Contest reward
- Severity: medium
- Program: Astaria
- Credited: bin2chen
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/28
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AM-22
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LienToken.sol _payment()/_makePayment() in Astaria lending protocol
**Root cause:** _payment() calls tokenTransferFrom with the full paymentAmount without capping it to lien.amount, so the first lien in the loop receives the entire borrower-supplied amount.
**Steps:**
1. Call makePayment() with a paymentAmount covering multiple open liens
2. _makePayment() loops openLiens, calling _payment(collateralId, 0, paymentAmount, msg.sender) with full amount
3. _payment() executes `TRANSFER_PROXY.tokenTransferFrom(WETH, payer, payee, paymentAmount)` sending full amount to first lien owner
4. paymentAmount -= capitalSpent leaves remaining liens unpaid while borrower's full funds are spent
**How found:** Code review of _makePayment() loop and _payment() transfer: noticed paymentAmount passed uncapped to tokenTransferFrom rather than min(lien.amount, paymentAmount).
**Exploitation:** Borrower intending to repay all loans calls the multi-lien makePayment(); the first lien owner receives the entire paymentAmount, exceeding what is owed, and remaining liens stay open — borrower loses funds.
**Insight:** When a loop passes a running total into a per-item payment helper, check that the helper caps the transfer at the item's owed amount and returns actual spent; otherwise the first iteration drains the whole budget.