# If unlocked capital in pool falls below minRequiredCapital, then protection can be bought for minimum premium

When pool total capital drops below minRequiredCapital, PremiumCalculator falls back to minimum premium, letting buyers purchase protection far too cheaply.

- Payout: Contest reward
- Severity: medium
- Program: Carapace
- Credited: jkoppel
- Disclosed: 2023-02-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-carapace-judging/issues/211
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PremiumCalculator / RiskFactorCalculator smart contracts
**Root cause:** canCalculateRiskFactor returns false for three distinct conditions (capital below min, leverage below floor, leverage above ceiling), but calculatePremium treats all false cases identically by setting the minimum premium.
**Steps:**
1. Observe PremiumCalculator.calculatePremium: if canCalculateRiskFactor is false, `_isMinPremium = true`.
2. Read RiskFactorCalculator.canCalculateRiskFactor: returns false when `_totalCapital < _minRequiredCapital` OR leverage ratio out of [floor, ceiling].
3. Cause total capital to fall below minRequiredCapital while leverage ratio stays in range (sellers withdraw, positions expire, or capital locked).
4. Buy protection: premium is computed as minimum premium instead of being prohibitively expensive or reverting.
**How found:** Code reading of PremiumCalculator and RiskFactorCalculator; noticed the boolean conflates three conditions with different economic meanings, and that the min-capital case should make protection expensive, not cheap.
**Exploitation:** Buyer waits until pool capital is below minRequiredCapital but leverage ratio still within bounds, then purchases protection at minimum premium, obtaining cheap coverage that should be very expensive.
**Insight:** When a helper returns a single boolean for multiple failure conditions, check whether the caller treats them all identically — economically opposite states (too much leverage vs too little capital) can collapse into the same cheap-price branch.