# Any duration can be passed by node operator

GoGoPool createMinipool lacks duration bounds, letting a node operator pass duration=1 to minimize slashing penalties on their GGP stake.

- Payout: Contest reward
- Severity: medium
- Program: GoGoPool
- Credited: immeas
- Disclosed: 2023-03-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-gogopool-findings/issues/492
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AM-14
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** MinipoolManager.sol createMinipool / slash
**Root cause:** createMinipool stores the caller-supplied duration without validating it against the intended 14-365 day range; slash() computes expected rewards (and thus GGP slash amount) proportional to that duration.
**Steps:**
1. Call `createMinipool(nodeID, duration=1, delegationFee, avaxAssignmentRequest)` with a deposit; duration=0 reverts on zero-transfer in Vault, so use 1.
2. Rialto calls `claimAndInitiateStaking` then `recordStakingStart`.
3. After staking, trigger `recordStakingEnd` with 0 rewards; slash path runs `getExpectedAVAXRewardsAmt(duration=1, avaxLiquidStakerAmt)` = avaxAmt*rate*1/365days.
4. Observe `ggpSlashAmt < 0.00001 ether` while nodeOp retains nearly all staked GGP.
**How found:** Code review of createMinipool noting no validation on the duration parameter, then tracing duration into getExpectedAVAXRewardsAmt and slash() to see it scales the penalty.
**Exploitation:** Node operator registers a minipool with duration=1, staking normally; when slashed, the expected-rewards-based slash amount is near zero, so they avoid the intended penalty on their GGP stake.
**Insight:** When a user-supplied parameter feeds a penalty/reward formula, check whether its bounds are enforced at entry; a near-zero value can neutralize slashing even when zero itself reverts.