A liquidity provider can withdraw all his funds anytime
Since some users provide liquidity to sell the insurance policies, it is important that these providers cannot withdraw their funds when the security breach happens and the policyholders are submitting claims. The liquidity providers can only request their funds first and withdraw them later (in a week).\\n```\\nfunction requestWithdrawal(uint256 \\_tokensToWithdraw) external override {\\n  WithdrawalStatus \\_status = getWithdrawalStatus(msg.sender);\\n\\n  require(\\_status == WithdrawalStatus.NONE || \\_status == WithdrawalStatus.EXPIRED,\\n    "PB: Can't request withdrawal");\\n\\n  uint256 \\_daiTokensToWithdraw = \\_tokensToWithdraw.mul(getDAIToDAIxRatio()).div(PERCENTAGE\\_100);\\n  uint256 \\_availableDaiBalance = balanceOf(msg.sender).mul(getDAIToDAIxRatio()).div(PERCENTAGE\\_100);\\n\\n  if (block.timestamp < liquidityMining.getEndLMTime().add(neededTimeAfterLM)) {\\n    \\_availableDaiBalance = \\_availableDaiBalance.sub(liquidityFromLM[msg.sender]);\\n  }\\n\\n  require(totalLiquidity >= totalCoverTokens.add(\\_daiTokensToWithdraw),\\n    "PB: Not enough liquidity");\\n\\n  require(\\_availableDaiBalance >= \\_daiTokensToWithdraw, "PB: Wrong announced amount");\\n\\n  WithdrawalInfo memory \\_newWithdrawalInfo;\\n  \\_newWithdrawalInfo.amount = \\_tokensToWithdraw;\\n  \\_newWithdrawalInfo.readyToWithdrawDate = block.timestamp.add(withdrawalPeriod);\\n\\n  withdrawalsInfo[msg.sender] = \\_newWithdrawalInfo;\\n  emit RequestWithdraw(msg.sender, \\_tokensToWithdraw, \\_newWithdrawalInfo.readyToWithdrawDate);\\n}\\n```\\n\\n```\\nfunction withdrawLiquidity() external override {\\n  require(getWithdrawalStatus(msg.sender) == WithdrawalStatus.READY,\\n    "PB: Withdrawal is not ready");\\n\\n  uint256 \\_tokensToWithdraw = withdrawalsInfo[msg.sender].amount;\\n  uint256 \\_daiTokensToWithdraw = \\_tokensToWithdraw.mul(getDAIToDAIxRatio()).div(PERCENTAGE\\_100);\\n\\n  if (withdrawalQueue.length != 0 || totalLiquidity.sub(\\_daiTokensToWithdraw) < totalCoverTokens) {\\n    withdrawalQueue.push(msg.sender);\\n  } else {\\n    \\_withdrawLiquidity(msg.sender, \\_tokensToWithdraw);\\n  }\\n}\\n```\\n\\nThere is a restriction in `requestWithdrawal` that requires the liquidity provider to have enough funds at the moment of request:\\n```\\nrequire(totalLiquidity >= totalCoverTokens.add(\\_daiTokensToWithdraw),\\n  "PB: Not enough liquidity");\\n\\nrequire(\\_availableDaiBalance >= \\_daiTokensToWithdraw, "PB: Wrong announced amount");\\n```\\n\\nBut after the request is created, these funds can then be transferred to another address. When the request is created, the provider should wait for 7 days, and then there will be 2 days to withdraw the requested amount:\\n```\\nwithdrawalPeriod = 1 weeks;\\nwithdrawalExpirePeriod = 2 days;\\n```\\n\\nThe attacker would have 4 addresses that will send the pool tokens to each other and request withdrawal of the full amount one by one every 2 days. So at least one of the addresses can withdraw all of the funds at any point in time. If the liquidity provider needs to withdraw funds immediately, he should transfer all funds to that address and execute the withdrawal.
Resolution\\nThe funds are now locked when the withdrawal is requested, so funds cannot be transferred after the request, and this bug cannot be exploited anymore.\\nOne of the solutions would be to block the DAIx tokens from being transferred after the withdrawal request.
```\\nfunction requestWithdrawal(uint256 \\_tokensToWithdraw) external override {\\n  WithdrawalStatus \\_status = getWithdrawalStatus(msg.sender);\\n\\n  require(\\_status == WithdrawalStatus.NONE || \\_status == WithdrawalStatus.EXPIRED,\\n    "PB: Can't request withdrawal");\\n\\n  uint256 \\_daiTokensToWithdraw = \\_tokensToWithdraw.mul(getDAIToDAIxRatio()).div(PERCENTAGE\\_100);\\n  uint256 \\_availableDaiBalance = balanceOf(msg.sender).mul(getDAIToDAIxRatio()).div(PERCENTAGE\\_100);\\n\\n  if (block.timestamp < liquidityMining.getEndLMTime().add(neededTimeAfterLM)) {\\n    \\_availableDaiBalance = \\_availableDaiBalance.sub(liquidityFromLM[msg.sender]);\\n  }\\n\\n  require(totalLiquidity >= totalCoverTokens.add(\\_daiTokensToWithdraw),\\n    "PB: Not enough liquidity");\\n\\n  require(\\_availableDaiBalance >= \\_daiTokensToWithdraw, "PB: Wrong announced amount");\\n\\n  WithdrawalInfo memory \\_newWithdrawalInfo;\\n  \\_newWithdrawalInfo.amount = \\_tokensToWithdraw;\\n  \\_newWithdrawalInfo.readyToWithdrawDate = block.timestamp.add(withdrawalPeriod);\\n\\n  withdrawalsInfo[msg.sender] = \\_newWithdrawalInfo;\\n  emit RequestWithdraw(msg.sender, \\_tokensToWithdraw, \\_newWithdrawalInfo.readyToWithdrawDate);\\n}\\n```\\n