# Incorrect `LienToken.changeInSlope` calculation can lead to vault insolvency

LienToken.changeInSlope omits INTEREST_DENOMINATOR and interest/expiry logic, inflating newSlope and underflowing slope, breaking vault accounting.

- Payout: Contest reward
- Severity: medium
- Program: Astaria
- Credited: 0xRajeev
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/189
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AM-8
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error

**Target:** LienToken.sol changeInSlope / calculateSlope
**Root cause:** changeInSlope computes newSlope without the INTEREST_DENOMINATOR and without the _getOwed/_getInterest logic (lien.last, expiry) used by calculateSlope, so newSlope is inflated relative to oldSlope.
**Steps:**
1. Read `calculateSlope` (L440-445) which uses `_getOwed`/`_getInterest` accounting for `lien.last` and expiry.
2. Read `changeInSlope` (L453-469) and note newSlope lacks INTEREST_DENOMINATOR and interest/expiry handling.
3. Observe `slope = oldSlope - newSlope` underflows because oldSlope (with denominator) < inflated newSlope.
4. Trigger changeInSlope via lien interaction to cause revert/incorrect slope.
**How found:** Compared the two slope functions by code reading and noticed changeInSlope diverged from calculateSlope: missing INTEREST_DENOMINATOR and missing _getOwed/_getInterest handling of lien.last and expiry.
**Insight:** When two functions compute the same economic quantity, diff them line-by-line for missing scaling constants (denominators) and time/expiry handling; a missing denominator flips a subtraction into an underflow.