Description

Parameters such as the _gsPool in StakingRouter's functions could be checked for validity. For example,

function withdrawEsGsForPool(address _gsPool) external nonReentrant {
    IVester(poolTrackers[_gsPool].vester).withdrawForAccount(msg.sender);
}

lacks a check that the _gsPool is a valid address in the poolTrackers mapping.

Impact

Failure to properly check the validity of parameters could lead to unexpected behavior, which in this case would have resulted in a failed external call. It is a good security practice to ensure the validity of parameters before using them, especially when these refer to arbitrary addresses.

Recommendations

In the function above, the _gsPool parameter could be checked that it exists within the poolTrackers mapping. This would prevent the function from being called with an invalid _gsPool address.

function withdrawEsGsForPool(address _gsPool) external nonReentrant {
+   require(poolTrackers[_gsPool].vester != address(0), "StakingRouter: Pool not found");
    IVester(poolTrackers[_gsPool].vester).withdrawForAccount(msg.sender);
}

Remediation