https://github.com/code-423n4/2023-04-eigenlayer/blob/398cc428541b91948f717482ec973583c9e76232/src/contracts/libraries/Merkle.sol#L129
Whenever merkleizeSha256 is being used in the code, there is always a check that array length is power of 2. E.x.:
contracts/libraries/BeaconChainProofs.sol#L131
But inside the function merkleizeSha256, there is no check that incoming array is power of 2. 
There is a @notice that doesnt hold.
But whenever there is a require in natspec inside the project, it always holds. E.x.:
src/contracts/core/DelegationManager.sol#L89
/src/contracts/strategies/StrategyBase.sol#L72
You can insert this into remix to check:
Either remove @notice or add this code for more security because sometimes you can just forget to check array size before calling that function:
Remix:
Sidu28 (EigenLayer) disputed, disagreed with severity and commented:
Alex the Entreprenerd (judge) decreased severity to QA and commented:
