The protocol allows an operator to overleverage by staking its vault to multiple DSSes. When a malicious behavior occurs, all of these DSSes can request to slash the operators vault by calling the following requestSlashing function that further calls the fetchEarmarkedStakes function below. Because the sum of these DSSes allowed slashing percentages can be more than 100%, the sum of the token amounts to be slashed by these DSSes calculated by the fetchEarmarkedStakes function can be more than the vaults underlying token balance. This incentivizes the DSSes to frontrun each other when finalizing the slashings. The DSSes, which successfully frontrun the others, can slash their allowed slashing percentages of the vaults underlying token balance; however, the DSSes, which get frontran by the others, can fail to slash any of the vaults underlying tokens because calling the slashAssets function below executes transferAmount = Math.min(totalAssets(), totalAssetsToSlash) but the vaults totalAssets() is already 0 after the other DSSes frontrunnings have slashed all of the vaults underlying token balance. Although the DSSes, which fail to slash the vault, can jail the operator afterwards but that is after the fact, and these DSSes have already suffered the damage caused by the operators misbehavior without being compensated at all.
https://github.com/code-423n4/2024-07-karak/blob/d19a4de35bcaf31ccec8bccd36e2d26594d05aad/src/entities/SlasherLib.sol#L94-L124
https://github.com/code-423n4/2024-07-karak/blob/d19a4de35bcaf31ccec8bccd36e2d26594d05aad/src/entities/SlasherLib.sol#L79-L92
https://github.com/code-423n4/2024-07-karak/blob/53eb78ebda718d752023db4faff4ab1567327db4/src/Vault.sol#L193-L205
Each time the operator attempts to stake its vault to a DSS, the total slashing percentage against the vault after adding the new DSSs allowed slashing percentage must not exceed 100%; otherwise, such staking function call of the operator should revert.
