# MinipoolManager: node operator can avoid being slashed

Node operator picks a >365-day minipool duration so the GGP slash amount exceeds their stake, making recordStakingEnd revert and slashing be skipped.

- Payout: Contest reward
- Severity: high
- Program: GoGoPool
- Credited: HollaDieWaldfee
- Disclosed: 2023-03-21
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-12-gogopool-findings/issues/136
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** MinipoolManager / Staking smart contracts (Solidity)
**Root cause:** slash() computes slashGGPAmt from expected AVAX rewards over the full duration and calls decreaseGGPStake, which underflows (subUint) when the slash exceeds the operator's staked GGP, reverting recordStakingEnd.
**Steps:**
1. Create minipool with depositAmt=1000 ether, avaxAssignmentRequest=1000 ether, duration=366 days, staking 100 ether GGP
2. Liquid staker deposits via ggAVAX.depositAVAX
3. Rialto calls claimAndInitiateStaking and recordStakingStart
4. skip(duration) then Rialto calls `recordStakingEnd{value: validationAmt}(nodeID, block.timestamp, 0 ether)`
5. avaxTotalRewardAmt==0 triggers slash(); slashGGPAmt > ggpStaked causes subUint underflow revert; with 365 days it succeeds
**How found:** Reading recordStakingEnd's zero-reward slash path and tracing slash() -> calculateGGPSlashAmt -> Staking.decreaseGGPStake, noticing the unchecked subtraction against the operator's actual GGP balance; confirmed boundary at 365 vs 366 days via Foundry test.
**Exploitation:** Operator intentionally selects a duration (or relies on GGP price drop) making the computed slash exceed their GGP stake; recordStakingEnd reverts, Rialto falls back to recordStakingError, letting the operator withdraw GGP that should have been slashed.
**Insight:** When a penalty is computed from expected yield over a user-chosen duration, check whether the penalty can exceed the collateral and revert the whole settlement path — a revert in the slash branch becomes a bypass, not just a DoS.