# Admin of the index pool can withdrawCredit() after applyCover() to avoid taking loss for the compensation paid for a certain pool

Index pool admin can withdrawCredit() after applyCover() is triggered, escaping compensation liability while keeping earned premiums, leaving pool LPs to absorb the loss.

- Payout: Audit contest
- Severity: high
- Program: InsureDAO
- Found by: WatchPug
- Disclosed: 2022-03-15
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-01-insure-findings/issues/281
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AH-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PoolTemplate.sol withdrawCredit / IndexTemplate credit allocation
**Root cause:** withdrawCredit() only checks marketStatus == Trading, not payout status; after applyCover() the pool is still in Trading so index pools can pull credit before resume(), zeroing their share of compensation.
**Steps:**
1. Pool A totalCredit=10,000, rewardPerCredit=1
2. Index Pool 1 allocates 1,000 credits to Pool A via set()/adjustAlloc(); totalCredit=11,000, indicies[IndexPool1]=1,000
3. rewardPerCredit grows to 1.1; applyCover() called for an incident
4. Index Pool 1 calls IndexTemplate.withdraw() -> PoolTemplate.withdrawCredit(1,000), collecting 100 premium; totalCredit back to 10,000, indicies=0
5. After pendingEnd, Pool A resume(); Index Pool 1 pays nothing toward compensation since credit is 0
**How found:** Code review of withdrawCredit()'s state guard: noticed it only requires MarketStatus.Trading, and that applyCover() does not transition the pool out of Trading, so credit withdrawal remains possible during the payout period.
**Exploitation:** Index pool admin monitors for applyCover() on a pool they invested in, then immediately calls withdraw()/withdrawCredit() to extract premium and zero their credit before the payout window closes, avoiding the loss that LPs of the pool must cover.
**Insight:** When a protocol enters a 'payout/incident' state, check whether every value-moving function's guard actually excludes that state; a status enum that isn't updated on incident declaration leaves withdrawal paths open for first-mover exit.