Submitted by ladboy233, also found by hansfriese
https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/MinipoolManager.sol#L560
https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/MinipoolManager.sol#L676
The validation rewards can be inaccurately displayed to user and the slahsed amount can be wrong when slashing happens.
Note the function below:
As outlined in the comment section, the function is intended to  calculate how much AVAX should be earned via validation rewards.
Besides displaying the reward, this function is also used in the function slash.
Note the code:
The slashedGGPAmt is calculated based on the AVAX reward amount.
However, the estimation of the validation rewards is not accurate.
According to the doc:
https://docs.avax.network/nodes/build/set-up-an-avalanche-node-with-microsoft-azure
This implies that the staking length affect staking rewards, but this is kind of vague. What is the exact implementation of the reward calculation?
The implementation is linked below:
https://github.com/ava-labs/avalanchego/blob/master/vms/platformvm/reward/calculator.go#L40
Note the reward calculation formula:
However, in the current ExpectedRewardAVA, the implementation is just:
AVAX reward rate * avax amount * duration / 365 days.
Clearly, the implementation of the avalanche side is more sophisticated and accurate than the implemented ExpectedRewardAVA.
We recommend the project make the ExpectedRewardAVA implementation match the implement.
https://github.com/ava-labs/avalanchego/blob/master/vms/platformvm/reward/calculator.go#L40
0xju1ie (GoGoPool) commented:
emersoncloud (GoGoPool) acknowledged and commented:
Alex the Entreprenerd (judge) commented:
emersoncloud (GoGoPool) commented:
For this contest, 15 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by IllIllI received the top score from the judge.
The following wardens also submitted reports: brgltd, pauliax, lukris02, betweenETHlines, sces60107, AkshaySrivastav, ast3ros, 0xSmartContract, HollaDieWaldfee, cozzetti, Rolezn, codeislight, chaduke, and RaymondFam.
