# User can game protection via renewal to get free insurance

Carapace renewal only checks time/token/lending contract, not amount, letting users renew to max protection cheaply right before a late payment.

- Payout: Contest reward
- Severity: high
- Program: Carapace
- Credited: rvierdiiev
- Disclosed: 2023-02-01
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-carapace-judging/issues/293
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ProtectionPool renewal logic (ProtectionPoolHelper.sol / ProtectionPool.sol)
**Root cause:** Renewal validation in ProtectionPoolHelper only verifies time, token and lending contract, never that the renewed protectionAmount matches the previously purchased amount, so users can renew for more coverage than they paid for.
**Steps:**
1. Open many tiny positions (protectionAmount=1) on the same LP token, spacing expirations to align with the grace period so a renew is always available.
2. Monitor the underlying Goldfinch lending pool state directly for an imminent late payment.
3. Right before the payment is officially late, call renew on a position with protectionAmount set to the token's max value.
4. Pay negligible premium for the tiny original position but receive full protection; collect full repayment on default.
**How found:** Code review of the renewal path: noticed the validation in ProtectionPoolHelper only checks time/token/lending contract and omits the protection amount, then reasoned that unlimited small positions plus off-chain visibility of Goldfinch state enable timing the renewal before a late payment.
**Exploitation:** Attacker keeps cheap 1-unit positions renewable at will, watches Goldfinch pool status off-chain, and renews to max protection just before a late payment is registered on Carapace, paying near-zero premium yet receiving full default coverage.
**Insight:** When auditing renewal/rollover logic, check whether every parameter of the new position is validated against the old one—especially amounts—since unvalidated amount fields let users upgrade coverage without paying the corresponding premium.