Liquid Staking

Summary

Calling a valid OperatorVault::raiseAlert would reward the caller as stated on Chainlink docs, but the OperatorVault is not transferring portion of the reward to the operator, making the call not profitable and instead the opreator reward is lost.

Vulnerability Details

OperatorVault.sol#L126-L137

opRewards is calculated and deducted when transfering the token to vaultController address but after that there are no action for opRewards as this variable is local variable then it would dissapear after the call is completed

Impact

Operator would lose their reward when calling the raiseAlert function, making the call not provitable and would make the vaultController lose potential reward that can be received from raising valid alert.
This is significant loses for the protocol overall.

Tools Used

manual review

Recommendations

There would be varying recommendation for this issue, and I prefer the first one to make the operator reward logic not much changed:

1. add the value of opRewards after calling raiseAlert in the state variable unclaimedRewards

2. add code to transfer the opRewards to the operator inside the raiseAlert function similar to vaultController