# avoid paying insurance

Flash-loan deposit inflates insurance pool so getPoolFundingRate returns 0, letting attacker set insurance funding rate to zero and dodge insurance payments.

- Payout: Audit contest
- Severity: medium
- Program: Tracer
- Found by: gpersoon
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-06-tracer-findings/issues/30
- Library page: https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AM-12
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** Insurance.sol / Trader.sol funding-rate logic
**Root cause:** getPoolFundingRate derives the insurance rate from current poolHoldings vs poolTarget; a transiently over-filled pool (via flash loan) yields rate 0, which updateFundingRate persists via setInsuranceFundingRate.
**Steps:**
1. Flash loan or hold large token amount; call `deposit` on Insurance.sol so `poolHoldings` > `poolTarget`.
2. Call `executeTrade` on Trader.sol with a minimal (possibly 0-value) trade.
3. executeTrade -> matchOrders -> recordTrade -> `updateFundingRate()`.
4. updateFundingRate -> getPoolFundingRate returns 0 because pool is full; setInsuranceFundingRate stores 0.
5. Withdraw from Insurance and repay flash loan; insurance rate stays 0 for the period.
**How found:** Reading the funding-rate update path: noticed getPoolFundingRate depends on instantaneous poolHoldings, which is manipulable within a single transaction, and that updateFundingRate only fires once per hour on the first trade.
**Exploitation:** Attacker times the sequence as the first trade each hour so updateFundingRate runs while the pool is artificially full, persisting a 0 insurance funding rate; gas + flash-loan fees vs insurance savings decide profitability, otherwise griefing.
**Insight:** When a rate/fee is computed from a spot pool balance and cached on a periodic trigger, check whether an attacker can transiently move that balance right before the trigger fires (flash loan + first-tx-of-period timing).