# Incorrect ticket price reference in JackpotBridgeManager causes user overpayment after price updates

JackpotBridgeManager reads global ticketPrice instead of the frozen drawing price, so mid-drawing price increases trap user overpayment and decreases cause DoS.

- Payout: Contest reward
- Severity: medium
- Program: Megapot
- Credited: avoloder
- Disclosed: 2026-01-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-11-megapot#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-02
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:dos

**Target:** JackpotBridgeManager.buyTickets cross-chain ticket purchase flow
**Root cause:** JackpotBridgeManager fetches jackpot.ticketPrice() (global, mutable) rather than the current drawing's frozen ticketPrice from getDrawingState, so the amount pulled/approved diverges from what Jackpot actually charges.
**Steps:**
1. Initialize jackpot with drawing 1 at ticketPrice = 1 USDC.
2. Admin calls `jackpot.setTicketPrice(usdc(3))` mid-drawing; drawing 1 still charges 1 USDC.
3. User calls `jackpotBridgeManager.buyTickets(tickets, recipient, referrers, splits, source)` for 2 tickets.
4. Manager pulls 2*3 = 6 USDC from user and approves 6 USDC to Jackpot.
5. Jackpot pulls only 2*1 = 2 USDC; 4 USDC remains stuck in the manager.
6. Reverse case: price decrease makes manager approve less than Jackpot requires, reverting with insufficient approval (DoS).
**How found:** Compared Jackpot's per-drawing frozen parameter model (ticketPrice set at drawing init) against JackpotBridgeManager's use of the global jackpot.ticketPrice() getter, then reasoned about both price-increase and price-decrease directions.
**Exploitation:** No attacker profit path shown; a user simply overpays when admin raises price mid-drawing and excess USDC is stranded in the bridge manager. Price decrease bricks buyTickets via insufficient-approval revert.
**Insight:** When a protocol freezes per-epoch parameters but exposes a separate mutable global getter, audit every peripheral contract (bridges, routers, aggregators) for reading the global value instead of the epoch snapshot; check both directions of the delta for overcharge and DoS.