# The number of deposits in a round can be larger than MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND

YoloV2 lets deposits exceed MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND when a round starts while paused, breaking the fixed-100-deposits invariant.

- Payout: Contest reward
- Severity: medium
- Program: Looksrare
- Credited: 0xMAKEOUTHILL
- Disclosed: 2024-01-16
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-01-looksrare-judging/issues/78
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-looksrare%3AM-2
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic

**Target:** YoloV2 lottery contract (depositETHIntoMultipleRounds/rolloverETH)
**Root cause:** _startRound only draws a full round when not paused, so a round started during pause stays OPEN with 100 deposits; depositETHIntoMultipleRounds and rolloverETH lack a max-deposit check in _depositETH.
**Steps:**
1. Fill round 1 and round 2 to 100 deposits each via `depositETHIntoMultipleRounds` with 2-element amounts array.
2. Admin calls `togglePaused()` before VRF returns.
3. VRF calls `rawFulfillRandomWords`; round 2 starts OPEN but is not drawn because paused.
4. Admin unpauses; before `drawWinner`, user calls `depositETHIntoMultipleRounds` adding a deposit to round 2.
5. Assert `getRound(2)` deposits length == 101.
**How found:** Code reading of _startRound's `!paused()` guard versus missing max-deposit check in _depositETH, then reasoned about pause timing relative to VRF fulfillment.
**Insight:** When an invariant is enforced only at one call site (draw/start), check whether alternate entry points (multi-round deposit, rollover) and pause-state transitions can bypass it; pause windows around async oracle callbacks are a classic gap.