Summary

Individual user needs to call depositIntoVault() by themselves to transfer deposited assets into the vault.

Vulnerability Details

Users, most likely those who are not tech-savvy, may be missing out from vault reward if they forget to call depositIntoVault(). Since the function logic does not allow delegation, these users' assets will stay in Steaking contract and will not generate yield.

Impact

No yield will be generated by assets that remain in the Steaking contract.

Tools Used

Manual review.

Recommendations

Consider allowing call delegations and credit the asset owners with the shares received from the vault. Batched calls by the development team can also be an option.