Submitted by __141345__, also found by HollaDieWaldfee, PaludoX0, Deivitto, ak1, cryptostellar5, Nyx, ck, ladboy233, 0xbepresent, cccz, csanuragjain, rvierdiiev, and RaymondFam
https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/Staking.sol#L328-L332
https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/ClaimNodeOp.sol#L89-L114
https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/ClaimProtocolDAO.sol#L20-L35
The whenNotPaused modifier is used to pause minipool creation and staking/withdrawing GGP. However, there are several cases this modifier could be bypassed, which breaks the intended admin control function and special mode.
stake()
In paused mode, no more stakeGGP() is allowed,
However, restakeGGP() is still available, which potentially violate the purpose of pause mode.
withdraw()
In paused mode, no more withdrawGGP() is allowed,
However, claimAndRestake() is still available, which can withdraw from the vault.
The function spend() can also ignore the pause mode to withdraw from the vault. But this is a guardian function. It could be intended behavior.
emersoncloud (GoGoPool) confirmed
Alex the Entreprenerd (judge) commented:
emersoncloud (GoGoPool) mitigated:
Status: Mitigation confirmed by RaymondFam and hansfriese.
