Liquid Staking

Summary

In VaultControllerStrategy, fees are limited to 3000 basis points in total, this is used to prevent users from losing all of their yield to fees. However, in LSTRewardsSplitter fees are restricted to just being <= 10000 basis points.
if (_totalFeesBasisPoints() > 10000) revert FeesExceedLimit();

Vulnerability Details

Under the condition that fee.basisPoints = 10000 in LSTRewardsSplitter::_splitRewards, amount transferred to the fee.receiver will be all of the rewards amount.
uint256 amount = (_rewardsAmount * fee.basisPoints) / 10000;
rewardsAmount * 10000 / 10000 = rewardsAmount
so all of the rewards will be transferred to the fee receiver and the actual staker will get no rewards.

Impact

Staker will be unable to receive rewards.

Tools Used

Manual

Recommendations

The totalFeesBasisPoints restrictions should be consistent: they cannot be > 3000 throughout anywhere in the the protocol, to ensure the fee is reasonable and users don't have all their yield absorbed by the feeReceiver.