GGP will keep inflating while the protocol is paused

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/Ocyticus.sol#L37

Vulnerability details

Impact

Ocyticus.pauseEverything() is called when the defender wants to pause the whole protocol. However, it doesn’t pause RewardPool. So GGP will keep inflating while the protocol is paused. This is unfair since no one can create mini pool to share the inflated GGP when the protocol is paused.

Proof of Concept

Ocyticus.pauseEverything() doesn’t pause RewardPool

https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/Ocyticus.sol#L37

	function pauseEverything() external onlyDefender {
		ProtocolDAO dao = ProtocolDAO(getContractAddress("ProtocolDAO"));
		dao.pauseContract("TokenggAVAX");
		dao.pauseContract("MinipoolManager");
		dao.pauseContract("Staking");
		disableAllMultisigs();
	}

But GGP will keep inflating while the protocol is paused.

Tools Used

Manual Review

Recommended Mitigation Steps

Ocyticus.pauseEverything() should also pause RewardPool

[c4-judge]

GalloDaSballo marked the issue as duplicate of #823

[c4-judge]

GalloDaSballo marked the issue as satisfactory