Liquid Staking

The VaultDepositController::withdraw function and the VaultDepositController::deposit functions are meant to be called by the VaultControllerStrategy using delegatecall from functions callable only by the stakingPool. However, neither of these functions check if the msg.sender == stakingPool, which allows anybody to bypass the onlyOwner guard in the StakingPool::strategyDeposit and StakingPool::strategyWithdraw functions and allows them to manually deposit/withdraw asset tokens into/from from a vault.

As a result, anybody to act out as a trusted entity, the stakingPool, withdraw asset tokens from vaults for themselves on behalf of the stakingPool or making the protocol behaves unpredictably by manually depositing asset tokens into vault.

Recommendation

Add the onlyStakingPool modifier to the VaultDepositController::withdraw and VaultDepositController::deposit functions.