Description

The staking amount is tracked in the _stakingAmount state variable. However, it is not updated when the manager withdraws from the staking vault. Because the contract accounts for staking using a debt token, the actual staked amount can differ from the value stored in _stakingAmount.

function withdrawFromStakingVault(uint256 amount) external onlyManager {
    smartVaultManager.stakingVault().withdraw(amount, address(smartVaultManager), address(this));
}

Impact

While this is not a security issue, this can cause inconsistent accounting.

Recommendations

Update _stakingAmount whenever the manager withdraws from the staking vault to keep the recorded amount in sync with the actual staked balance.

Remediation