Liquid Staking

Summary

Users would be unable to withdraw their funds if another user maliciously deposits into the vaults that are in their claim period

Vulnerability Details

When a vault in claim is deposited, the funds are rebonded
https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/base/VaultControllerStrategy.sol#L215-L217
https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/base/VaultControllerStrategy.sol#L245

this would mean that they are no longer withdrawable and would have to be unbonded again
malicious users can continue to do this on every vault cycle, depositing miniscule amounts ensuring other users cannot withdraw

Impact

Users will never be able to withdraw their funds

Tools Used

manual analysis

Recommendations

Users should not be able to deposit into unbonded vaults