Multiple withdrawals of the same AVAX deposit

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/MinipoolManager.sol#L293-L302

Vulnerability details

Impact

The node operator may withdraw the same AVAX deposit amount multiple times.

Proof of Concept

Recreated minipool still has the originally deposited AVAX amount in storage, even though this deposit was already withdrawn by calling withdrawMinipoolFunds(...) (here). This allows for multiple withdrawals of deposit amount of AVAX but only once sending AVAX to protocol (on creation of minipool). Consider scenario:

• node operator creates minipool and deposits 1000 AVAX
• minipool enters Withdrawable state and the node operator withdraws deposit and rewards
• minipool multisig address calls recreateMinipool(...) to recreate minipool
• after some time, when minipool enters Withdrawable state again, the node operator can withdraw deposit again

The amount of provided deposit is only reset when the minipool is updated with createMinipool(...), but not with recreateMinipool(...).

Tools Used

Maunal review

Recommended Mitigation Steps

Consider resetting the amount of the deposit when recreating the minipool.

[c4-judge]

GalloDaSballo marked the issue as duplicate of #484

[c4-judge]

GalloDaSballo marked the issue as partial-50

[GalloDaSballo]

Less grounded in reality (front-run is necessary), but ultimately shows a wrong FSM state so valid

[c4-judge]

GalloDaSballo marked the issue as duplicate of #569

[c4-judge]

GalloDaSballo changed the severity to 2 (Med Risk)

[c4-judge]

GalloDaSballo changed the severity to QA (Quality Assurance)

[Simon-Busch]

Changed the severity back to M as requested by @GalloDaSballo