Users of StakingFundsVault can never redeem their LP token once staking has started

Lines of code Vulnerability details The burnLPToken of a Fees & MEV vault allow users to burn LP tokens in exchange of ETH. Quoting the documentation Every user has a right to leave the LSD network at anytime. A depositor/staker can simply sell their LP tokens to someone else or burn to redeem ET...

an early staker in StakingFundsVault can take other stakers eth

Lines of code Vulnerability details Impact The first stakers in a StakingFundsVault can intentionally or unintentionally take ethfrom other stakers. If they claim rewards while eth is in the contract but yet not used to stake towards a validator that eth can be counted as rewards. Proof of Concep...

potential reentrancy risk in _distributeETHRewardsToUserForToken

Lines of code Vulnerability details potential reentrancy risk in distributeETHRewardsToUserForToken Impact Reentrancy risk can potentially be demaging Proof of Concept distributeETHRewardsToUserForToken, which in turn calls bool success, = recipient.callvalue: due"";. As recipient of ETH, the...

HIGH: ETH is forever locked in GiantMevAndFeesPool due to unaccepted burn()

Lines of code Vulnerability details Description GiantMevAndFeesPools and StakingFundsVault implement beforeTokenTransfer transfer hooks. StakingFundsVault.sol: function beforeTokenTransferaddress from, address to, uint256 external override address syndicate = liquidStakingNetworkManager.syndicate...