Staking.restakeGGP should not be allowed when contract is paused

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/Staking.sol#L328-L332
https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/ClaimNodeOp.sol#L106

Vulnerability details

Impact

Staking.restakeGGP should not be allowed when contract is paused. Even that it's only callable by ClaimNodeOp, it's still can be directly called by user through ClaimNodeOp.claimAndRestake.

Proof of Concept

When Staking contract is paused, then staking and withdrawing of GGP is disallowed. So both stakeGGP and withdrawGGP functions have whenNotPaused modifier.
Also there is another possibility to stake GGP using Staking.restakeGGP function. It's only callable by ClaimNodeOp. And this function doesn't have whenNotPaused modifier.
https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/Staking.sol#L328-L332

	function restakeGGP(address stakerAddr, uint256 amount) public onlySpecificRegisteredContract("ClaimNodeOp", msg.sender) {
		// Transfer GGP tokens from the ClaimNodeOp contract to this contract
		ggp.safeTransferFrom(msg.sender, address(this), amount);
		_stakeGGP(stakerAddr, amount);
	}

restakeGGP can be called only by ClaimNodeOp. It is called inside ClaimNodeOp.claimAndRestake function.
https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/ClaimNodeOp.sol#L89-L114

	function claimAndRestake(uint256 claimAmt) external {
		Staking staking = Staking(getContractAddress("Staking"));
		uint256 ggpRewards = staking.getGGPRewards(msg.sender);
		if (ggpRewards == 0) {
			revert NoRewardsToClaim();
		}
		if (claimAmt > ggpRewards) {
			revert InvalidAmount();
		}


		staking.decreaseGGPRewards(msg.sender, ggpRewards);


		Vault vault = Vault(getContractAddress("Vault"));
		uint256 restakeAmt = ggpRewards - claimAmt;
		if (restakeAmt > 0) {
			vault.withdrawToken(address(this), ggp, restakeAmt);
			ggp.approve(address(staking), restakeAmt);
			staking.restakeGGP(msg.sender, restakeAmt);
		}


		if (claimAmt > 0) {
			vault.withdrawToken(msg.sender, ggp, claimAmt);
		}


		emit GGPRewardsClaimed(msg.sender, claimAmt);
	}

As you can see this function can be called by anyone who has ggp rewards.
So using ClaimNodeOp.claimAndRestake user can dismiss restriction for staking ggp when Staking contract is paused.

Tools Used

VsCode

Recommended Mitigation Steps

Add whenNotPaused modifier to Staking.restakeGGP function.

[c4-judge]

GalloDaSballo marked the issue as duplicate of #351

[c4-judge]

GalloDaSballo marked the issue as duplicate of #673

[c4-judge]

GalloDaSballo marked the issue as satisfactory

[c4-judge]

GalloDaSballo changed the severity to 2 (Med Risk)