# Armor Bugfix Review

Armor ClaimManager multiplied an already-WEI claim amount by 10^18, letting a $1 policy withdraw 10^18 times more assets than purchased.

- Payout: $876,000
- Severity: critical
- Program: Armor
- Found by: Alexander Schlindwein
- Disclosed: 2021-02-10
- Write-up quality: 6/10
- Original: https://immunefi.com/blog/bug-fix-reviews/armor-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-armor-bugfix-review
- Tags: area:web3 domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ClaimManager.sol smart contract claim payout logic
**Root cause:** Line 62 `uint256 payment = _amount * 10 ** 18;` re-applied an ETH-to-WEI conversion to `_amount`, which was already denominated in WEI, inflating the payout by 10^18.
**Steps:**
1. User holds a coverage policy and files a claim against the coverage pool.
2. ClaimManager computes `uint256 payment = _amount * 10 ** 18;` on line 62, treating WEI as ETH.
3. Line 64 `msg.send.transfer(payment)` sends the inflated WEI amount to the claimant.
4. A $1 policy yields a payout 10^18 times larger than purchased, exceeding available pool assets.
**How found:** CTO assessed the contract code and identified the redundant unit conversion on line 62, recognizing `_amount` was already in WEI.
**Exploitation:** An attacker buys minimal coverage, triggers a claim, and the inflated `payment` value is transferred via `msg.send.transfer(payment)`, draining far more than the policy value and more than the pool holds.
**Insight:** In Solidity payout code, verify the denomination of every amount variable; a stray `* 10 ** 18` on an already-WEI value is a classic unit-confusion bug that inflates transfers by 10^18.

## Proof of concept (copied exactly from the original report)

**Faulty payment calculation in ClaimManager.sol**

```
In ClaimManager.sol, line 62 uint256 payment = _amount * 10 ** 18; should not have been present in the contract.
The call on line 64, msg.send.transfer(payment), sends an amount of WEI to the target contract.
```