search

code-423n4 / 2022-01-insure-findings

2 stars 0 forks source link

anyone can get money from an incident without paying beforehand #183

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

danb

Vulnerability details

https://github.com/code-423n4/2022-01-insure/blob/main/contracts/PoolTemplate.sol#L655

applyCover can be frontrun with insure call in order to get the incident money.

I suggest you add the same mechanism in withdraw, add requestInsure which must be called some time before insure.

oishun1112 commented 2 years ago

applyCover takes parameter named "_incidentTimestamp". _incidentTimestamp is always sometime before, so doing front-run for applyCover has no meaning.

0xean commented 2 years ago

Agree with sponsor that this isn't feasible unless the owner called with an incidentTimestamp in the future 

 require(
            marketStatus == MarketStatus.Payingout &&
                _insurance.startTime <= _incidentTimestamp &&
                _insurance.endTime >= _incidentTimestamp,
            "ERROR: INSURANCE_NOT_APPLICABLE"
        );
0xean commented 2 years ago

lowering to non critical as sponsor may choose to add a require statement to force incidentTimestamp < block.timestamp