Liquid Staking

Impact

When a strategy gets added, the protocol immediately approves type(uint256).max). This poses significant centralisation risk as the compromisation of one single strategy will result in the balance getting drained.

StakingPool.sol should only call safeApprove when it needs to deposit into a strategy. That way, it reduces the risk of the protocol getting fully drained all because of one strategy. And that loss of funds can be capped in the unlikely senario that a strategy is rogue.

Recommended

Use token.safeApprove only when you want to deposit into the strategy, and set it to the exact amount that StakingPool is depositing inside, and not type(uint256).max.