Submitted by oakcobalt, also found by oakcobalt, Stormy, and 0xDING99YA
userTotalStaked invariant will be broken due to vulnerable implementations in release(). Users might lose funds due to underflow errors in withdraw methods.
According to the readme, userTotalStaked invariant should always hold true:
userTotalStaked[address] = selfStakes[address].amount + sum(communityStakes[address][x].amount for all x staked on by this address)
However, this can be broken in release() flow due to userTotalStaked is not updated together with selfStakes[address].amount or communityStakes[address][x].amount.
https://github.com/code-423n4/2024-03-gitcoin/blob/6529b351cd72a858541f60c52f0e5ad0fb6f1b16/id-staking-v2/contracts/IdentityStaking.sol#L562-L563
For comparison, in other flows such as staking, withdrawing and slashing, userTotalStaked is always updated in sync with selfStakes/communityStakes.
POC:
See test below:
In id-staking-v2/test/IdentityStaking.ts, first add import { PANIC_CODES} from "@nomicfoundation/hardhat-chai-matchers/panic";. 
Then copy this test inside describe("slashing/releasing/burning tests", function () {.
Hardhat
In release(), also update userTotalStaked.
nutrina (Gitcoin) confirmed
Alex the Entreprenerd (judge) commented:
Gitcoin mitigated:
Status: Mitigation confirmed. Full details in reports from oakcobalt, Stormy and 0xDING99YA.
For this audit, 2 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by oakcobalt received the top score from the judge.
The following wardens also submitted reports: EV_om.
