The number of deposits in a round can be larger than MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND
The number of deposits in a round can be larger than MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND, because there is no such check in depositETHIntoMultipleRounds() function or rolloverETH() function.\\ndepositETHIntoMultipleRounds() function is called to deposit ETH into multiple rounds, so it's possible that the number of deposits in both current round and next round is MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND.\\nWhen current round's number of deposits reaches MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND, the round is drawn:\\n```\\n        if (\\n            _shouldDrawWinner(\\n                startingRound.numberOfParticipants,\\n                startingRound.maximumNumberOfParticipants,\\n                startingRound.deposits.length\\n            )\\n        ) {\\n            _drawWinner(startingRound, startingRoundId);\\n        }\\n```\\n\\n_drawWinner() function calls VRF provider to get a random number, when the random number is returned by VRF provider, fulfillRandomWords() function is called to chose the winner and the next round will be started:\\n```\\n                _startRound({_roundsCount: roundId});\\n```\\n\\nIf the next round's deposit number is also MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND, _startRound() function may also draw the next round as well, so it seems that there is no chance the the number of deposits in a round can become larger than MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND:\\n```\\n            if (\\n                !paused() &&\\n                _shouldDrawWinner(numberOfParticipants, round.maximumNumberOfParticipants, round.deposits.length)\\n            ) {\\n                _drawWinner(round, roundId);\\n            }\\n```\\n\\nHowever, _startRound() function will draw the round only if the protocol is not paused. Imagine the following scenario:\\nThe deposit number in `round 1` and `round 2` is MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND;\\n`round 1` is drawn, before random number is sent back by VRF provider, the protocol is paused by the admin for some reason;\\nRandom number is returned and fulfillRandomWords() function is called to start round 2;\\nBecause protocol is paused, `round 2` is set to OPEN but not drawn;\\nLater admin unpauses the protocol, before drawWinner() function can be called, some users may deposit more funds into `round 2` by calling depositETHIntoMultipleRounds() function or rolloverETH() function, this will make the deposit number of `round 2` larger than MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND.\\nPlease run the test code to verify:\\n```\\n    function test_audit_deposit_more_than_max() public {\\n        address alice = makeAddr("Alice");\\n        address bob = makeAddr("Bob");\\n\\n        vm.deal(alice, 2 ether);\\n        vm.deal(bob, 2 ether);\\n\\n        uint256[] memory amounts = new uint256[](2);\\n        amounts[0] = 0.01 ether;\\n        amounts[1] = 0.01 ether;\\n\\n        // Users deposit to make the deposit number equals to MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND in both rounds\\n        uint256 MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND = 100;\\n        for (uint i; i < MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND / 2; ++i) {\\n            vm.prank(alice);\\n            yolo.depositETHIntoMultipleRounds{value: 0.02 ether}(amounts);\\n\\n            vm.prank(bob);\\n            yolo.depositETHIntoMultipleRounds{value: 0.02 ether}(amounts);\\n        }\\n\\n        // owner pause the protocol before random word returned\\n        vm.prank(owner);\\n        yolo.togglePaused();\\n\\n        // random word returned and round 2 is started but not drawn\\n        vm.prank(VRF_COORDINATOR);\\n        uint256[] memory randomWords = new uint256[](1);\\n        uint256 randomWord = 123;\\n        randomWords[0] = randomWord;\\n        yolo.rawFulfillRandomWords(FULFILL_RANDOM_WORDS_REQUEST_ID, randomWords);\\n\\n        // owner unpause the protocol\\n        vm.prank(owner);\\n        yolo.togglePaused();\\n\\n        // User deposits into round 2\\n        amounts = new uint256[](1);\\n        amounts[0] = 0.01 ether;\\n        vm.prank(bob);\\n        yolo.depositETHIntoMultipleRounds{value: 0.01 ether}(amounts);\\n\\n        (\\n            ,\\n            ,\\n            ,\\n            ,\\n            ,\\n            ,\\n            ,\\n            ,\\n            ,\\n            YoloV2.Deposit[] memory round2Deposits\\n        ) = yolo.getRound(2);\\n\\n        // the number of deposits in round 2 is larger than MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND\\n        assertEq(round2Deposits.length, MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND + 1);\\n    }\\n```\\n
Add check in _depositETH() function which is called by both depositETHIntoMultipleRounds() function and rolloverETH() function to ensure the deposit number cannot be larger than MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND:\\n```\\n        uint256 roundDepositCount = round.deposits.length;\\n\\n// Add the line below\\n       if (roundDepositCount >= MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND) {\\n// Add the line below\\n           revert MaximumNumberOfDepositsReached();\\n// Add the line below\\n       }\\n\\n        _validateOnePlayerCannotFillUpTheWholeRound(_unsafeAdd(roundDepositCount, 1), round.numberOfParticipants);\\n```\\n
This issue break the invariant that the number of deposits in a round can be larger than MAXIMUM_NUMBER_OF_DEPOSITS_PER_ROUND.
```\\n        if (\\n            _shouldDrawWinner(\\n                startingRound.numberOfParticipants,\\n                startingRound.maximumNumberOfParticipants,\\n                startingRound.deposits.length\\n            )\\n        ) {\\n            _drawWinner(startingRound, startingRoundId);\\n        }\\n```\\n