# Rialto may not be able to cancel minipools created by contracts that cannot receive AVAX

A node operator contract that rejects AVAX blocks Rialto's cancelMinipoolByMultisig, since refund uses safeTransferETH and reverts, preventing minipool cancellation.

- Payout: Contest reward
- Severity: medium
- Program: GoGoPool
- Credited: Jeiwan
- Disclosed: 2023-03-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-gogopool-findings/issues/623
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AM-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** MinipoolManager.cancelMinipoolByMultisig / _cancelMinipoolAndReturnFunds
**Root cause:** _cancelMinipoolAndReturnFunds pushes the node operator's AVAX refund via safeTransferETH to the minipool owner; if the owner is a contract that reverts on receiving AVAX, the whole cancel transaction reverts.
**Steps:**
1. Deploy a contract `NodeOpContract {}` with no receive/fallback.
2. Fund it with GGP and AVAX, stake GGP, and call `createMinipool(depositAmt, avaxAssignmentRequest, duration)` from it.
3. Set minipool status to Prelaunch.
4. Rialto calls `cancelMinipoolByMultisig(nodeID, errorCode)`; refund `owner.safeTransferETH(avaxNodeOpAmt)` reverts with ETH_TRANSFER_FAILED.
**How found:** Code reading of cancelMinipoolByMultisig traced the refund path to safeTransferETH to the owner, hypothesizing a contract owner could revert the transfer and grief cancellation; confirmed with a Foundry PoC.
**Exploitation:** Malicious node operator registers a minipool from a contract that cannot receive AVAX; when Rialto attempts to cancel the minipool, the ETH refund push reverts, denying cancellation.
**Insight:** When a privileged admin action refunds a user, check whether the refund is a push to an attacker-controlled address; a reverting receiver can permanently block the admin path. Look for safeTransferETH/call to owner inside state-changing admin functions.