# Node operator is getting slashed for full duration even though rewards are distributed based on a 14 day cycle

GoGoPool slashing used full staking duration instead of the 14-day reward cycle, over-slashing node operators up to 26x the missed yield.

- Payout: Contest reward
- Severity: high
- Program: GoGoPool
- Credited: immeas
- Disclosed: 2023-03-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-gogopool-findings/issues/493
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** MinipoolManager.sol slash / getExpectedAVAXRewardsAmt
**Root cause:** getExpectedAVAXRewardsAmt multiplies the reward rate by the full user-chosen staking duration, but rewards are actually distributed in 14-day Rialto cycles, so missed-reward slashing is computed over the entire duration.
**Steps:**
1. Create minipool with `duration = 365 days`, deposit 1000 ether, avaxAssignmentRequest 1000 ether, stake 200 ether GGP.
2. Rialto calls `claimAndInitiateStaking` then `recordStakingStart`.
3. `skip(2 weeks)` to simulate one reward cycle.
4. Rialto calls `recordStakingEnd` with 0 rewards, triggering `slash`.
5. Observe `ggpSlashAmt` = 100 eth (10%) vs ~3.8 eth for a 14-day duration.
**How found:** Code reading of slash() and getExpectedAVAXRewardsAmt revealed the duration parameter is the user-supplied staking duration, while the protocol's reward distribution is documented as 14-day cycles; PoC compared slash amounts for 365-day vs 14-day durations.
**Exploitation:** Node operator with low availability during a single 14-day cycle is slashed based on the full multi-month duration, losing principal far exceeding the actual missed rewards; repeated unavailability re-slashes full duration each cycle.
**Insight:** When a protocol separates user-facing staking duration from internal reward epochs, check every formula consuming the user duration (slashing, penalties, reward math) for epoch-vs-duration mismatch.