Vulnerability: Existing buyer who has been regularly renewing protection will be denied renewal even when she is well within the renewal grace period
Severity: high

Description:
Existing buyers have an opportunity to renew their protection within grace period. If lending state update happens from `Active` to `LateWithinGracePeriod` just 1 second after a buyer's protection expires, protocol denies buyer an opportunity even when she is well within the grace period.\\nSince defaults are not sudden and an `Active` loan first transitions into `LateWithinGracePeriod`, it is unfair to deny an existing buyer an opportunity to renew (its alright if a new protection buyer is DOSed). This is especially so because a late loan can become `active` again in future (or move to `default`, but both possibilities exist at this stage).\\nAll previous protection payments are a total loss for a buyer when she is denied a legitimate renewal request at the first sign of danger.\\n`renewProtection` first calls `verifyBuyerCanRenewProtection` that checks if the user requesting renewal holds same NFT id on same lending pool address & that the current request is within grace period defined by protocol.\\nOnce successfully verified, `renewProtection` calls `_verifyAndCreateProtection` to renew protection. This is the same function that gets called when a new protection is created.\\nNotice that this function calls `_verifyLendingPoolIsActive` as part of its verification before creating new protection - this check denies protection on loans that are in `LateWithinGracePeriod` or `Late` phase (see snippet below).\\n```\\nfunction _verifyLendingPoolIsActive(\\n    IDefaultStateManager defaultStateManager,\\n    address _protectionPoolAddress,\\n    address _lendingPoolAddress\\n  ) internal view {\\n    LendingPoolStatus poolStatus = defaultStateManager.getLendingPoolStatus(\\n      _protectionPoolAddress,\\n      _lendingPoolAddress\\n    );\\n\\n    // rest of code\\n    if (\\n      poolStatus == LendingPoolStatus.LateWithinGracePeriod ||\\n      poolStatus == LendingPoolStatus.Late\\n    ) {\\n      revert IProtectionPool.LendingPoolHasLatePayment(_lendingPoolAddress);\\n    }\\n    // rest of code\\n}\\n```\\n

Impact:
User who has been regularly renewing protection and paying premium to protect against a future loss event will be denied that very protection when she most needs it.\\nIf existing user is denied renewal, she can never get back in (unless the lending pool becomes active again). All her previous payments were a total loss for her.

Recommended mitigation:
When a user is calling `renewProtection`, a different implementation of `verifyLendingPoolIsActive` is needed that allows a user to renew even when lending pool status is `LateWithinGracePeriod` or `Late`.\\nRecommend using `verifyLendingPoolIsActiveForRenewal` function in renewal flow as shown below\\n```\\n  function verifyLendingPoolIsActiveForRenewal(\\n    IDefaultStateManager defaultStateManager,\\n    address _protectionPoolAddress,\\n    address _lendingPoolAddress\\n  ) internal view {\\n    LendingPoolStatus poolStatus = defaultStateManager.getLendingPoolStatus(\\n      _protectionPoolAddress,\\n      _lendingPoolAddress\\n    );\\n\\n    if (poolStatus == LendingPoolStatus.NotSupported) {\\n      revert IProtectionPool.LendingPoolNotSupported(_lendingPoolAddress);\\n    }\\n    //------ audit - this section needs to be commented-----//\\n    //if (\\n    //  poolStatus == LendingPoolStatus.LateWithinGracePeriod ||\\n    //  poolStatus == LendingPoolStatus.Late\\n    //) {\\n    //  revert IProtectionPool.LendingPoolHasLatePayment(_lendingPoolAddress);\\n    //}\\n    // ---------------------------------------------------------//\\n\\n    if (poolStatus == LendingPoolStatus.Expired) {\\n      revert IProtectionPool.LendingPoolExpired(_lendingPoolAddress);\\n    }\\n\\n    if (poolStatus == LendingPoolStatus.Defaulted) {\\n      revert IProtectionPool.LendingPoolDefaulted(_lendingPoolAddress);\\n    }\\n  }\\n```\\n