StakingContract - PubKey Length Checks Not Always Enforced
`addValidators` checks that the provided `bytes pubKey` is a multiple of the expected pubkey length while functions like `setWithdrawer` do not enforce similar length checks. This is an inconsistency that should be avoided.\\n`addValidators` enforcing input length checks\\n```\\nfunction addValidators(\\n uint256 \\_operatorIndex,\\n uint256 \\_keyCount,\\n bytes calldata \\_publicKeys,\\n bytes calldata \\_signatures\\n) external onlyActiveOperator(\\_operatorIndex) {\\n if (\\_keyCount == 0) {\\n revert InvalidArgument();\\n }\\n\\n if (\\_publicKeys.length % PUBLIC\\_KEY\\_LENGTH != 0 || \\_publicKeys.length / PUBLIC\\_KEY\\_LENGTH != \\_keyCount) {\\n revert InvalidPublicKeys();\\n }\\n```\\n\\n`setWithdrawer` accepting any length for a `pubKey`. Note that `_getPubKeyRoot` will take any input provided and concat it the zero bytes.\\n```\\n/// @notice Set withdrawer for public key\\n/// @dev Only callable by current public key withdrawer\\n/// @param \\_publicKey Public key to change withdrawer\\n/// @param \\_newWithdrawer New withdrawer address\\nfunction setWithdrawer(bytes calldata \\_publicKey, address \\_newWithdrawer) external {\\n if (!StakingContractStorageLib.getWithdrawerCustomizationEnabled()) {\\n revert Forbidden();\\n }\\n \\_checkAddress(\\_newWithdrawer);\\n bytes32 pubkeyRoot = \\_getPubKeyRoot(\\_publicKey);\\n StakingContractStorageLib.WithdrawersSlot storage withdrawers = StakingContractStorageLib.getWithdrawers();\\n\\n if (withdrawers.value[pubkeyRoot] != msg.sender) {\\n revert Unauthorized();\\n }\\n\\n emit ChangedWithdrawer(\\_publicKey, \\_newWithdrawer);\\n\\n withdrawers.value[pubkeyRoot] = \\_newWithdrawer;\\n}\\n```\\n\\n```\\nfunction \\_getPubKeyRoot(bytes memory \\_publicKey) internal pure returns (bytes32) {\\n return sha256(abi.encodePacked(\\_publicKey, bytes16(0)));\\n}\\n```\\n\\nsimilarly, the withdraw family of functions does not enforce a pubkey length either. However, it is unlikely that someone finds a pubkey that matches a root for the attackers address.\\n```\\n/// @notice Withdraw the Execution Layer Fee for a given validator public key\\n/// @dev Funds are sent to the withdrawer account\\n/// @param \\_publicKey Validator to withdraw Execution Layer Fees from\\nfunction withdrawELFee(bytes calldata \\_publicKey) external {\\n \\_onlyWithdrawerOrAdmin(\\_publicKey);\\n \\_deployAndWithdraw(\\_publicKey, EXECUTION\\_LAYER\\_SALT\\_PREFIX, StakingContractStorageLib.getELDispatcher());\\n}\\n```\\n\\nNevertheless, the methods should be hardened so as not to give a malicious actor the freedom to use an unexpected input size for the `pubKey` argument.
Enforce pubkey length checks when accepting a single pubkey as bytes similar to the batch functions that check for a multiple of ´PUBLIC_KEY_LENGTH´. Alternatively, declare the function argument as `bytes48` (however, in this case inputs may be auto-padded to fit the expected length, pot. covering situations that otherwise would throw an error)
```\\nfunction addValidators(\\n uint256 \\_operatorIndex,\\n uint256 \\_keyCount,\\n bytes calldata \\_publicKeys,\\n bytes calldata \\_signatures\\n) external onlyActiveOperator(\\_operatorIndex) {\\n if (\\_keyCount == 0) {\\n revert InvalidArgument();\\n }\\n\\n if (\\_publicKeys.length % PUBLIC\\_KEY\\_LENGTH != 0 || \\_publicKeys.length / PUBLIC\\_KEY\\_LENGTH != \\_keyCount) {\\n revert InvalidPublicKeys();\\n }\\n```\\n