# Users can deposit "0" ether to any round

LooksRare Yolo depositETHIntoMultipleRounds accepts zero-amount deposits to any round, inserting duplicate entry indexes that corrupt winner selection.

- Payout: Contest reward
- Severity: high
- Program: Looksrare
- Credited: 0rpse
- Disclosed: 2024-01-16
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-01-looksrare-judging/issues/18
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-looksrare%3AH-2
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** YoloV2 depositETHIntoMultipleRounds (Solidity contract)
**Root cause:** The loop only checks depositAmount % roundValuePerEntry != 0, which passes for 0, and expectedValue += 0 keeps msg.value check satisfied, so zero deposits are recorded without incrementing entryIndex.
**Steps:**
1. Call `deposit{value: 1 ether}(1, ...)` to seed round 1 normally.
2. Call `depositETHIntoMultipleRounds{value: 1 ether}([1 ether, 0, 0])`.
3. Loop records zero-amount deposits in rounds 2 and 3 with currentEntryIndex 0, duplicating the index.
4. Winner selection using upper-bound index logic is skewed by duplicate indexes.
**How found:** Reviewer noticed the modulo check passes for 0 and that expectedValue += 0 leaves the msg.value equality intact, allowing zero deposits alongside a legitimate one.
**Exploitation:** Attacker pays only gas plus one normal deposit to inject zero-value entries into arbitrary future rounds, biasing the index array used to pick winners.
**Insight:** When a batch function validates a sum against msg.value, per-element zero values slip through modulo/equality checks; check each element for nonzero, not just the aggregate.