# Insolvency: The Lottery may incorrectly consider a year old jackpot ticket as unclaimed and increase currentNetProfit by its prize while it was actually claimed

Lottery counts a year-old jackpot as unclaimed in executeDraw while claimWinningTickets still pays it at the exact boundary timestamp, leaving the contract insolvent.

- Payout: Contest reward
- Severity: medium
- Program: Wenwin
- Credited: NoamYakov
- Disclosed: 2023-04-12
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-wenwin-findings/issues/167
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-wenwin%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Lottery.sol executeDraw / claimWinningTickets / claimable
**Root cause:** claimable() uses block.timestamp <= ticketRegistrationDeadline(drawId + DRAWS_PER_YEAR) while returnUnclaimedJackpotToThePot treats the same boundary as unclaimed, so both paths succeed at the exact scheduled draw time when drawCoolDownPeriod is zero.
**Steps:**
1. Deploy/observe Lottery with drawCoolDownPeriod == 0.
2. Eve buys ticket in draw #1 and wins jackpot.
3. Wait until block.timestamp equals scheduled draw date of draw #53 (also registration deadline of draw #53).
4. In one transaction call `lottery.executeDraw()` then `lottery.claimWinningTickets([eveJackpotTicketId])`.
5. executeDraw adds prize to currentNetProfit as unclaimed; claimWinningTickets still pays Eve the prize.
**How found:** Reading the docs on the 1-year claim window and comparing the boundary conditions in executeDraw/returnUnclaimedJackpotToThePot (>= scheduled draw) versus claimable (<= registration deadline), noticing both pass at the exact same timestamp when cooldown is zero.
**Exploitation:** Ticket owner waits exactly one year to the boundary timestamp and atomically calls executeDraw() followed by claimWinningTickets(), receiving the jackpot while the contract also credits the same amount to currentNetProfit, making the Lottery insolvent.
**Insight:** When a protocol defines an expiry window, check whether the 'expired' and 'still valid' checks use the same boundary operator; an inclusive <= on the claim side and inclusive >= on the reclaim side lets both fire at the exact deadline timestamp.