Liquid Staking

Vulnerability Details

When users call deposit in PriorityPool.sol, they are allowed to pass in their own _data of their choice since deposit is an external function.

However, the _data parameter is then passed on to _deposit followed by StakingPool's deposit() and subsequently _depositLiquidity(_data); which calls -> strategy.deposit(toDeposit, _data[i]);

Impact

The bytes array _data is passed all the way from the external function callable by the user to the deposit function of the strategy itself.

It should be included in the documentation that, strategy implementations should not extract any data from _data as it is not by the StakingPool contract but instead is coming straight from the user without validation.

Recommendation

It is best to remove the _data parameter since strategy implementors should not be trusting any information extracted from that bytes paramter either.