# Rounds can not be immediately drawn after fulfillRandomWords due to VRF contracts reentrancy guard

YoloV2 auto-draws the next round inside fulfillRandomWords, re-entering Chainlink VRF's nonReentrant requestRandomWords and reverting, so the drawn round never concludes.

- Payout: Contest reward
- Severity: medium
- Program: Looksrare
- Credited: mstpr-brainbot
- Disclosed: 2024-01-16
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-01-looksrare-judging/issues/43
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-looksrare%3AM-1
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:dos vuln:reentrancy

**Target:** YoloV2 lottery contract + Chainlink VRFCoordinatorV2
**Root cause:** _startRound immediately draws a winnable next round by calling VRF requestRandomWords from within the fulfillRandomWords callback, but VRFCoordinatorV2 holds a nonReentrant lock during that callback, so the nested request reverts.
**Steps:**
1. User deposits ETH into a future round so it becomes immediately drawable when current round ends.
2. Current round is drawn; VRF calls rawFulfillRandomWords -> fulfillRandomWords on YoloV2.
3. YoloV2 _startRound sees next round drawable and calls VRF requestRandomWords.
4. VRFCoordinatorV2 nonReentrant modifier reverts since lock set true during callback.
5. fulfillRandomWords reverts every time; round cannot conclude and must be cancelled by governance.
**How found:** Code-reading of YoloV2 _startRound auto-draw path against Chainlink VRFCoordinatorV2's nonReentrant modifier on requestRandomWords, noting the lock is held during the fulfillRandomWords callback.
**Insight:** When integrating callback-based oracles (VRF, any fulfill* pattern), check whether your callback handler calls back into the same oracle contract; nonReentrant locks held during the callback will revert nested requests, so defer follow-up requests to a separate tx.