GoGoPool audit contest
A public audit contest on Code4rena (Avalanche liquid staking), completed on 15th December 2022. 0xSimao placed #36. 3 of his findings are published: 3 medium.
What GoGoPool is
GoGoPool is a decentralised liquid staking protocol on Avalanche built to be the easiest way to stake AVAX: users with less than 2000 AVAX stake liquidly through ggAVAX, while node operators bring hardware plus a matching deposit and take delegations from the pool, with GGP collateral staked against their performance.
Scope
The full protocol: minipools, ggAVAX, GGP staking and rewards, the oracle and the DAO storage layer.
Medium severity findings
- Slashing fails when node operator doesn't have enough staked
GGP - Any duration can be passed by node operator
- Wrong reward distribution between early and late depositors because of the late
syncRewards()call in the cycle,syncReward()logic should be executed in each withdraw or deposits (without reverting)
The contest