Submitted by loop, also found by p4st13r4 and ye0lde
The function unlock() in PoolTemplate has a typo where it compares insurances[_id].status to false rather than setting it to false. If the conditions are met to unlock the funds for an id, the user should be able to call the unlock() function once for that id as insurances[_id].amount is subtracted from lockedAmount. However, since insurances[_id].status does not get set to false, a user can call unlock() multiple times for the same id, resulting in lockedAmount being way smaller than it should be since insurances[_id].amount is subtracted multiple times.
lockedAmount is used to calculate the amount of underlying tokens available for withdrawals. If lockedAmount is lower than it should be users are able to withdraw more underlying tokens than available for withdrawals.
Typo in unlock():
Calculation of underlying tokens available for withdrawal:
Change insurances[_id].status == false; to insurances[_id].status = false;
oishun1112 (Insure) confirmed and resolved:
0xean (judge) commented:
