# Protection buyer may buy multiple protections for same goldfinch NFT

Carapace only caps each protection against remainingPrincipal, so a buyer can stack multiple protections on one Goldfinch NFT, over-insuring and locking protocol capital.

- Payout: Contest reward
- Severity: high
- Program: Carapace
- Credited: libratus
- Disclosed: 2023-02-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-carapace-judging/issues/112
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AH-8
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Credit default swap protection purchase (ReferenceLendingPools.canBuyProtection)
**Root cause:** canBuyProtection validates each new protection against the loan's remainingPrincipal independently, without tracking total protection already subscribed for that loan/NFT, so cumulative coverage can exceed principal.
**Steps:**
1. Call buyProtection on a Goldfinch loan for an amount up to remainingPrincipal.
2. Call buyProtection again on the same loan/NFT for another amount up to remainingPrincipal.
3. Repeat until total protection far exceeds the actual lent principal.
4. Observe protocol capital locked and leverageRatioFloor approached, blocking new protections.
**How found:** Code review of ReferenceLendingPools.canBuyProtection: noticed the check compares only the single new protection to remainingPrincipal and never aggregates existing protections per loan.
**Exploitation:** Buyer purchases multiple protections against the same loan position; on default they could claim more than lent, and meanwhile the locked capital drives leverage ratio to its floor, DoSing further protection purchases.
**Escalation:** Repeated purchases drain available protocol capacity, hitting leverageRatioFloor and blocking all new protections (griefing/DoS).
**Insight:** When a cap check validates a single request against a shared pool/position, check whether cumulative state per position is tracked; per-call limits without aggregate accounting allow stacking.