# _makePayment is logically inconsistent with how lien stack is managed causing payments to multiple liens to fail

_makePayment iterates liens by index while _deleteLienPosition compresses the stack, so paying off multiple liens reverts with out-of-bounds.

- Payout: Contest reward
- Severity: medium
- Program: Astaria
- Credited: TurnipBoy
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/232
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AM-3
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** LienToken.sol payment loop
**Root cause:** _makePayment loops i from 0 to openLiens.length while _payment fully paying a lien calls _deleteLienPosition, which slides higher liens down and pops, shrinking the array mid-loop.
**Steps:**
1. Set liens[0].amount=100, liens[1].amount=50 on a collateralId
2. Call _makePayment(collateralId, 150)
3. i=0: _payment pays off lien 0, _deleteLienPosition(0) slides lien 1 into index 0 and pops
4. i=1: _payment reads index 1 which no longer exists -> OOB revert
**How found:** Code reading: noticed _makePayment iterates a memory copy of the array by index while _deleteLienPosition mutates storage length, hypothesized index desync when multiple liens are paid in one call.
**Insight:** When a loop iterates a snapshot of an array but the callee mutates the underlying storage array (shift-and-pop), indices desync; check any pay/claim loop that deletes elements it is iterating.