Adversary can stake LP directly for the vault then withdraw to break lp accounting in BLVaultManagerLido
The AuraRewardPool allows users to stake directly for other users. In this case the malicious user could stake LP directly for their vault then call withdraw on their vault. This would cause the LP tracking to break on BLVaultManagerLido. The result is that some users would now be permanently trapped because their vault would revert when trying to withdraw.\\nBaseRewardPool.sol#L196-L207\\n```\\nfunction stakeFor(address _for, uint256 _amount)\\n    public\\n    returns(bool)\\n{\\n    _processStake(_amount, _for);\\n\\n    //take away from sender\\n    stakingToken.safeTransferFrom(msg.sender, address(this), _amount);\\n    emit Staked(_for, _amount);\\n    \\n    return true;\\n}\\n```\\n\\nAuraRewardPool allows users to stake directly for another address with them receiving the staked tokens.\\nBLVaultLido.sol#L218-L224\\n```\\n    manager.decreaseTotalLp(lpAmount_);\\n\\n    // Unstake from Aura\\n    auraRewardPool().withdrawAndUnwrap(lpAmount_, claim_);\\n\\n    // Exit Balancer pool\\n    _exitBalancerPool(lpAmount_, minTokenAmounts_);\\n```\\n\\nOnce the LP has been stake the adversary can immediately withdraw it from their vault. This calls decreaseTotalLP on BLVaultManagerLido which now permanently break the LP account.\\nBLVaultManagerLido.sol#L277-L280\\n```\\nfunction decreaseTotalLp(uint256 amount_) external override onlyWhileActive onlyVault {\\n    if (amount_ > totalLp) revert BLManagerLido_InvalidLpAmount();\\n    totalLp -= amount_;\\n}\\n```\\n\\nIf the amount_ is ever greater than totalLP it will cause decreaseTotalLP to revert. By withdrawing LP that was never deposited to a vault, it permanently breaks other users from being able to withdraw.\\nExample: User A deposits wstETH to their vault which yields 50 LP. User B creates a vault then stake 50 LP and withdraws it from his vault. The manager now thinks there is 0 LP in vaults. When User A tries to withdraw their LP it will revert when it calls manger.decreaseTotalLp. User A is now permanently trapped in the vault.
Individual vaults should track how much they have deposited and shouldn't be allowed to withdraw more than deposited.
LP accounting is broken and users are permanently trapped.
```\\nfunction stakeFor(address _for, uint256 _amount)\\n    public\\n    returns(bool)\\n{\\n    _processStake(_amount, _for);\\n\\n    //take away from sender\\n    stakingToken.safeTransferFrom(msg.sender, address(this), _amount);\\n    emit Staked(_for, _amount);\\n    \\n    return true;\\n}\\n```\\n