# lpEarnings generated in emergency mode become stuck on the contract

In Megapot's emergency mode, claimWinnings still credits lpEarnings for referrer-less tickets, but runJackpot is disabled so these funds remain stuck forever.

- Payout: Contest reward
- Severity: medium
- Program: Megapot
- Credited: BengalCatBalu
- Disclosed: 2026-01-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-11-megapot#m-04
- Library page: https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity vuln:business-logic

**Target:** Jackpot.sol smart contract
**Root cause:** claimWinnings calls _payReferrersWinnings which adds to drawingState[currentDrawingId].lpEarnings even during emergency mode, but runJackpot (which would distribute lpEarnings) is blocked by noEmergencyMode modifier.
**Steps:**
1. Deploy Megapot system and initialize with USDC.
2. Buy a ticket with no referrer.
3. Run jackpot and provide randomness to complete drawing.
4. Enable emergency mode via `enableEmergencyMode()`.
5. Call `claimWinnings([ticketId])` for the winning ticket.
6. Observe that `drawingState[currentDrawingId].lpEarnings` increases but cannot be distributed.
**How found:** Auditor noticed that emergency mode is unrecoverable and that claimWinnings lacks the noEmergencyMode modifier, while _payReferrersWinnings still updates lpEarnings.
**Exploitation:** Any user can claim winnings during emergency mode, causing lpEarnings to accumulate on the contract. Since emergency mode is irreversible and runJackpot is disabled, these funds are permanently locked.
**Insight:** Check for state updates that occur in functions callable during emergency/paused states but whose distribution mechanism is disabled in those states.