Summary

OperatorVCS::removeVault() and OperatorVCS:queueVaultRemoval() has no access control or restriction and can be called by anyone.

Vulnerability Details

Users might mistakenly believe they are entitled to the entire _amount of LST when, in fact, there are no shares to back that claim. This could create confusion about their stake in the system.

Impact

A malicious actors could queue vaults for removal prematurely or unnecessarily.

Tools Used

Manual Review

Recommendations

Restrict the queueVaultRemoval function to specific roles (e.g only the vault operator) using role-based access control (RBAC) mechanisms like Ownable or AccessControl.