# Tickets can be entered after prizes for current round have partially been distributed

ThrusterTreasure's enterTickets only checks prize index 0, letting users buy tickets after higher-index prizes are distributed, so late tickets can't win those prizes.

- Payout: Audit contest
- Severity: medium
- Program: Thruster
- Found by: EV_om
- Disclosed: 2024-03-28
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-02-thruster#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-thruster%3AM-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:race-condition

**Target:** ThrusterTreasure lottery contract (enterTickets/setPrize/claimPrizesForRound)
**Root cause:** enterTickets gates on winningTickets[currentRound_][0].length == 0 only, so if prizes are set non-atomically (index 1+ before index 0), tickets can still be entered after those prizes are already distributed.
**Steps:**
1. Owner sets up a round with multiple prizes.
2. User A enters tickets early.
3. Owner distributes prizes for index 1 (setWinningTickets for index 1).
4. User B calls `enterTickets(_amount, _proof)`; the require on index 0 still passes.
5. User B's tickets are accepted but cannot win the already-distributed index-1 prizes.
**How found:** Code reading of enterTickets' guard against winningTickets[currentRound_][0]; noticed the check assumes all prizes are set atomically and only validates index 0, so non-atomic prize setting leaves a window.
**Exploitation:** A user (or front-runner) submits enterTickets in a block after the owner's setWinningTickets for a higher index lands but before index 0 is set; the tx succeeds and the user pays for tickets that cannot win the already-distributed prizes.
**Insight:** When a guard checks only element [0] of a per-index array to infer 'nothing distributed yet', test whether the array can be populated out of order or non-atomically; any partial write to higher indices bypasses the guard.