Submitted by WatchPug, also found by pmerkleplant, cmichel, Ruhum, and Dravee
There are ERC20 tokens that charge fee for every transfer() / transferFrom().
Vault.sol#addValue() assumes that the received amount is the same as the transfer amount, and uses it to calculate attributions, balance amounts, etc. While the actual transferred amount can be lower for those tokens.
https://github.com/code-423n4/2022-01-insure/blob/19d1a7819fe7ce795e6d4814e7ddf8b8e1323df3/contracts/Vault.sol#L124-L140
Consider comparing before and after balance to get the actual transferred amount.
oishun1112 (Insure) acknowledged:
