# AVAX Assigned High Water is updated incorrectly

GoGoPool's recordStakingStart incremented AVAXAssignedHighWater by each minipool's amount instead of setting it to current assigned AVAX, letting node operators inflate the high-water mark and over-claim rewards.

- Payout: Contest reward
- Severity: high
- Program: GoGoPool
- Credited: hansfriese
- Disclosed: 2023-03-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-gogopool-findings/issues/566
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** MinipoolManager.recordStakingStart / Staking AVAXAssignedHighWater accounting
**Root cause:** recordStakingStart adds avaxLiquidStakerAmt to AVAXAssignedHighWater whenever current assigned exceeds it, so successive minipools accumulate rather than reflecting the true maximum assigned amount.
**Steps:**
1. Create minipool1 with 1000 AVAX via `createMinipool(nodeID, 2 weeks, delegationFee, 1000e18)`; assigned AVAX = 1000.
2. Rialtor calls `recordStakingStart()`; AVAXAssignedHighWater becomes 1000.
3. After validation, create minipool2 with 1500 AVAX; assigned AVAX = 1500.
4. Call `recordStakingStart()` for minipool2; high water becomes 1000+1500=2500 instead of 1500.
5. High water only resets via `calculateAndDistributeRewards` after RewardsCycleSeconds (28 days), so inflated value persists across the reward cycle.
**How found:** Code reading of recordStakingStart's high-water update logic; noticed the conditional increase by avaxLiquidStakerAmt rather than assignment to getAVAXAssigned(owner), then constructed a two-minipool numeric example showing accumulation.
**Exploitation:** Node operator sequences minipool creation and staking starts so that each recordStakingStart adds the new minipool's liquid staker amount to an already-elevated high-water mark, inflating the recorded maximum assigned AVAX used for reward distribution and extracting more rewards than earned.
**Insight:** When a 'high water mark' variable is maintained, check whether updates use increment-by-delta versus set-to-current; any increment path can accumulate across sequential positions and inflate reward-weighted accounting.