# Slashing fails when node operator doesn't have enough staked GGP

GoGoPool slashing underflows when a node operator's staked GGP is less than the slash amount after a GGP price drop, letting them evade slashing entirely.

- Payout: Contest reward
- Severity: medium
- Program: GoGoPool
- Credited: immeas
- Disclosed: 2023-03-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-gogopool-findings/issues/494
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** MinipoolManager/Staking slashing logic (Solidity contracts)
**Root cause:** slashGGP calls decreaseGGPStake without checking the staker's balance; subUint underflows when the GGP slash amount (computed from current GGP-AVAX price) exceeds staked GGP.
**Steps:**
1. Stake just enough GGP (100 ether) and create a minipool with 1000 AVAX deposit + 1000 AVAX assignment for 365 days.
2. Deposit AVAX as liquid staker, claimAndInitiateStaking, recordStakingStart.
3. Skip 2 weeks, then set GGP price to 0.999 ether via oracle.
4. Call `minipoolMgr.recordStakingEnd{value: validationAmt}(mp1.nodeID, block.timestamp, 0 ether)` — reverts on underflow in `subUint`.
5. Only `recordStakingError` remains, which returns funds without slashing GGP.
**How found:** Code reading of calculateGGPSlashAmt and slashGGP revealed no balance check before subUint; noted the comment 'can fail due to underflow' and that price changes between minipool creation and slashing could trigger it.
**Exploitation:** Node operator with low availability foresees slashing; a small GGP price drop makes slashGGPAmt exceed staked GGP, causing subUint underflow and reverting recordStakingEnd. Protocol must call recordStakingError, returning funds without slashing, so operator evades penalty.
**Escalation:** Operator could deliberately manipulate GGP price just before period end to guarantee the underflow and evade slashing.
**Insight:** When a penalty amount is derived from a live oracle price and subtracted from a stored balance, check for missing balance clamping — any price drift can make the subtraction underflow and revert the whole settlement, converting a penalty into a free pass.