# LP pool cap may be exceeded on drawing settlement

JackpotLPManager settlement recomputes LP value without re-enforcing the pool cap, letting LP pool exceed governance cap and bonusballMax overflow, DoSing max-bonus ticket purchases.

- Payout: Contest reward
- Severity: high
- Program: Megapot
- Credited: montecristo
- Disclosed: 2026-01-05
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-11-megapot#h-03
- Library page: https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AH-03
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** JackpotLPManager.processDrawingSettlement / Jackpot pool cap logic
**Root cause:** processDrawingSettlement adds _lpEarnings to lpPoolTotal without re-checking _calculateLpPoolCap, so LP value can grow ~30% per no-winner draw past governancePoolCap; bonusballMax then exceeds 255-normalBallMax.
**Steps:**
1. Deploy with normalBallMax=15, governancePoolCap=630000e6; deposit LP up to lpPoolCap.
2. Buy tickets, run drawing, declare winning numbers with no winner so all sales accrue to LP.
3. Observe lpPoolTotal > governancePoolCap and bonusballMax > 255-normalBallMax.
4. Buy a ticket with bonusball = bonusballMax; `1 << (bonusball + normalMax)` overflows and reverts with Panic(0x11).
**How found:** Compared the cap enforcement in Jackpot._calculateLpPoolCap (bounding bonusBallMax+normalBallMax <= 256) against the settlement path in JackpotLPManager, noticing the new LP value computation omits the same cap check.
**Exploitation:** No direct theft; attacker (or any user) triggers a no-winner draw to inflate LP pool past cap, then max-bonus ticket purchases revert, DoSing betting and breaking pool-cap invariant.
**Insight:** When a protocol computes a safety cap in one contract, grep every other path that mutates the same state variable (settlement, earnings accrual) for a missing re-check; invariant docs listing 'never exceeds' are prime targets.