Liquid Staking

Summary
The vulnerability can allow an attacker to reenter the withdraw() function of the VaultControllerStrategy contract, causing the state variables to be updated only once even if token.safeTransfer() is called multiple times.

Vulnerability Details
https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/base/VaultControllerStrategy.sol#L155-L158

Impact
In the VaultControllertrategy contract, the withdraw() function does not have a reentrancy guard and updates state variables after calling token.safeTransfer(), this can lead to token.safeTransfer being called multiple times then updating the state variables totalDeposit amount and totalPrincipalDeposits amount only once.

Tools Used
Manual code review

Recommendations
A reentrancy guard modifier should be added to the withdraw() function then the state variables totalDeposit and totalPrincipalDeposits should be updated before the transfer in the withdraw function in VaultControllertrategy.sol.