Slashed GGP tokens are sent to a wrong contract and trapped

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/MinipoolManager.sol#L670
https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/Staking.sol#L379

Vulnerability details

Impact

Slashed GGP tokens are trapped in the ProtocolDAO contract and liquid stakers are not compensated.

Proof of Concept

The protocol has a mechanism to slash GGP tokens when the nodes did not operate well (uptime less than 80%).
But looking at the function slashGGP(), the slashed GGP tokens are transferred to the ProtocolDAO contract and there is no way to transfer/spend those.
I believe it is supposed to be sent to ClaimProtocolDAO contract, not the ProtocolDAO, so that it can be spent later.
Furthermore, I don't see any mechanism to compensate the victim liquid stakers.
I believe the protocol intends to exchange the slashed GGP tokens into AVAX and put into the TokenggAVAX so that liquid stakers can claim.

Staking.sol
379: 	function slashGGP(address stakerAddr, uint256 ggpAmt) public onlySpecificRegisteredContract("MinipoolManager", msg.sender) {
380: 		Vault vault = Vault(getContractAddress("Vault"));
381: 		decreaseGGPStake(stakerAddr, ggpAmt);
382: 		vault.transferToken("ProtocolDAO", ggp, ggpAmt);//@audit wrong contract?
383: 	}

Tools Used

Manual Review

Recommended Mitigation Steps

• Transfer the slashed GGP tokens to ClaimProtocolDAO contract so that the protocol can spend later.
• Implement a mechanism to compensate the liquid stakers when the node operator's GGP collateral is slashed.

[c4-judge]

GalloDaSballo marked the issue as duplicate of #532

[c4-judge]

GalloDaSballo marked the issue as satisfactory