# requestWithdraw without obligation to withdraw allow underwriter to avoid payout

Underwriters can repeatedly request withdrawal each lockup period, keeping effective lockup at half, letting them exit before a hack payout vote resolves.

- Payout: Audit contest
- Severity: medium
- Program: InsureDAO
- Found by: gzeon
- Disclosed: 2022-03-15
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-insure-findings/issues/295
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:race-window vuln:business-logic

**Target:** PoolTemplate.sol requestWithdraw lockup mechanism
**Root cause:** Withdrawal requests have a lockup period but no obligation to actually withdraw afterward, and capital keeps earning premium during lockup, so an underwriter can re-request each period to keep average lockup at half the configured period.
**Steps:**
1. Observe lockup period is 86400s (24h) in test cases and reporting DAO vote lasts 24h plus delay.
2. Underwriter calls `requestWithdraw` every 24h, resetting the lockup window.
3. Effective lockup averages lockup/2 (~12h), shorter than the time to detect a hack and pass a payout vote.
4. Underwriter withdraws before payout vote resolves, avoiding the loss while still earning yield.
**How found:** Reasoned about the gap between lockup period and the DAO reporting/vote timeline, noting no obligation to withdraw after lockup and that capital keeps earning during lockup, enabling a rolling-request strategy.
**Exploitation:** Underwriter continuously re-requests withdrawal each lockup period so their funds are always within ~half a lockup of being withdrawable; when a hack occurs they withdraw before the reporting DAO vote completes, avoiding payout while collecting premium.
**Insight:** When a lockup/cooldown gates withdrawal, check whether re-requesting resets the timer and whether the effective exit window is shorter than the event-resolution window it is meant to protect against.