Liquid Staking

Summary

The isRemoved() function in the Vault contract always returns false, regardless of whether the operator has actually been removed from the Chainlink staking contract.

Vulnerability Details

The isRemoved() function is defined as follows:

This function is hardcoded to always return false, which does not accurately reflect the actual status of the operator in the Chainlink staking contract.

Impact

Systems relying on this function will always be informed that the operator is not removed, even if it has been.

Tools Used

Manual Review

Recommendations

Implement proper logic to check the actual status of the operator in the Chainlink staking contract. This might involve querying the staking contract or maintaining an internal state that is updated when the operator status changes.