# Typo in PoolTemplate unlock function results in user being able to unlock multiple times

Typo `==` instead of `=` in PoolTemplate.unlock() leaves insurance status true, letting users unlock repeatedly and understate lockedAmount to over-withdraw pool funds.

- Payout: Audit contest
- Severity: high
- Program: InsureDAO
- Found by: loop
- Disclosed: 2022-03-15
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-insure-findings/issues/192
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PoolTemplate.sol
**Root cause:** `insurances[_id].status == false;` is a no-op comparison instead of an assignment, so the insurance status is never cleared after unlock.
**Steps:**
1. Meet unlock conditions for an insurance id.
2. Call `unlock(_id)`; `lockedAmount` decreases by `insurances[_id].amount` but status stays true.
3. Call `unlock(_id)` again repeatedly; `lockedAmount` keeps decreasing.
4. Withdraw underlying tokens using the artificially low `lockedAmount` (line 836) to drain more than entitled.
**How found:** Code review of unlock() spotted the `==` comparison where an assignment was intended, then traced lockedAmount usage in the withdrawal calculation.
**Exploitation:** Repeated calls to unlock() for the same id drive lockedAmount far below actual locked value, enabling withdrawal of more underlying tokens than available for withdrawals.
**Insight:** In Solidity, a bare `x == false;` statement is a silent no-op; grep for comparison statements used as standalone lines in state-changing functions to catch missing assignments.