refund - attacker can lock insurance holder's refunds by calling refund before a refund was allocated
`addPremium` is used to determine the `refund` amount that an insurance holder is eligible to claim. The amount is stored in the `refundMap` mapping and can then later be claimed by anyone on behalf of an insurance holder by calling `refund`. The `refund` function can't be called more than once for a given combination of `policyIndex_`, `week_`, and `who_`, as it would revert with an “Already refunded” error. This gives an attacker the opportunity to call `refund` on behalf of any insurance holder with value 0 inside the `refundMap`, causing any future `refund` allocated for that holder in a given week and for a given policy to be locked forever in the contract (unless the contract is upgraded).\\n```\\nfunction refund(\\n uint256 policyIndex\\_,\\n uint256 week\\_,\\n address who\\_\\n) external noReenter {\\n Coverage storage coverage = coverageMap[policyIndex\\_][week\\_][who\\_];\\n\\n require(!coverage.refunded, "Already refunded");\\n\\n uint256 allCovered = coveredMap[policyIndex\\_][week\\_];\\n uint256 amountToRefund = refundMap[policyIndex\\_][week\\_].mul(\\n coverage.amount).div(allCovered);\\n coverage.amount = coverage.amount.mul(\\n coverage.premium.sub(amountToRefund)).div(coverage.premium);\\n coverage.refunded = true;\\n\\n IERC20(baseToken).safeTransfer(who\\_, amountToRefund);\\n\\n if (eventAggregator != address(0)) {\\n IEventAggregator(eventAggregator).refund(\\n policyIndex\\_,\\n week\\_,\\n who\\_,\\n amountToRefund\\n );\\n }\\n}\\n```\\n
There should be a validation check at the beginning of the function that reverts if `refundMap[policyIndex_][week_] == 0`.
```\\nfunction refund(\\n uint256 policyIndex\\_,\\n uint256 week\\_,\\n address who\\_\\n) external noReenter {\\n Coverage storage coverage = coverageMap[policyIndex\\_][week\\_][who\\_];\\n\\n require(!coverage.refunded, "Already refunded");\\n\\n uint256 allCovered = coveredMap[policyIndex\\_][week\\_];\\n uint256 amountToRefund = refundMap[policyIndex\\_][week\\_].mul(\\n coverage.amount).div(allCovered);\\n coverage.amount = coverage.amount.mul(\\n coverage.premium.sub(amountToRefund)).div(coverage.premium);\\n coverage.refunded = true;\\n\\n IERC20(baseToken).safeTransfer(who\\_, amountToRefund);\\n\\n if (eventAggregator != address(0)) {\\n IEventAggregator(eventAggregator).refund(\\n policyIndex\\_,\\n week\\_,\\n who\\_,\\n amountToRefund\\n );\\n }\\n}\\n```\\n