# User can get free entries if the price of any whitelisted ERC20 token is greater than the round's `valuePerEntry`

YoloV2 whitelists token address but not token type, letting users deposit ERC20s as ERC721 with zero amounts to mint free raffle entries.

- Payout: Contest reward
- Severity: high
- Program: Looksrare
- Credited: Kow
- Disclosed: 2024-01-16
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2024-01-looksrare-judging/issues/4
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-looksrare%3AH-1
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** YoloV2 raffle deposit contract / TransferManager
**Root cause:** Deposit whitelist checks only tokenAddress (isCurrencyAllowed) and never validates that the declared tokenType matches the actual token standard, so an ERC20 can be submitted as ERC721.
**Steps:**
1. Whitelist an ERC20 (e.g. MKR) via updateCurrenciesStatus and add a price oracle.
2. Make one legitimate ERC20 deposit so prices[tokenAddress][roundId] is populated.
3. Submit a deposit with tokenType=ERC721, tokenAddress=MKR, and tokenIdsOrAmounts = [0,0,0].
4. TransferManager calls IERC721.transferFrom(from,to,0) on the ERC20; identical selector, amount 0, no balance needed.
5. entriesCount = price/valuePerEntry is credited for each zero entry, granting free raffle entries.
**How found:** Code review of the deposit path: noticed the whitelist check only inspects tokenAddress while tokenType is user-supplied, then reasoned that ERC20 and ERC721 transferFrom share a selector so a zero-amount ERC20 transfer satisfies the ERC721 branch.
**Exploitation:** Attacker needs no token balance: after a price is cached for the round, they submit ERC721-typed deposits of an ERC20 with zero amounts, each zero transfer succeeding and each credited as price/valuePerEntry entries, inflating win probability at zero cost.
**Escalation:** Repeat with arbitrary-length zero arrays up to max deposit limit and across multiple rounds to multiply free entries.
**Insight:** When a contract accepts a user-declared asset type alongside an address, check whether the type is validated against the actual token; identical function selectors across ERC20/ERC721 transferFrom let a zero-amount call satisfy the wrong branch.