MEDIUM severity: The vulnerability arises when an operator's validators are removed, allowing a user to frontrun a tr. The vulnerability arises when an operator's validators are removed, allowing a user to frontrun a transaction and cause excess Ether to become stuck in the EigenPod. This occurs when a full withdrawal is triggered, leaving the excess amount idle and only recoverable by reactivating the validators, w...

Vulnerable code:
```\nif (validatorDetails.cap > 0 && newValidatorCap == 0) {\n    if (activeDeposits > 0) {\n        operatorDetails.queueOperatorStrategyExit(operatorId, BEACON_CHAIN_STRATEGY);\n    }\n} else if (validatorDetails.cap == 0 && newValidatorCap > 0) {\n} else {\n}\n```\n```\nfunction queueOperatorStrategyExit(\n    IRioLRTOperatorRegistry.OperatorDetails storage operator,\n    uint8 operatorId,\n    address strategy\n) internal {\n    IRioLRTOperatorDelegator delegator = IRioLRTOperatorDelegator(operator.delegator);\n\n    uint256 sharesToExit;\n    if (strategy == BEACON_CHAIN_STRATEGY) {\n        // Queues an exit for verified validators only. Unverified validators must by exited once verified,\n        // and ETH must be scraped into the deposit pool. Exits are rounded to the nearest Gwei. It is not\n        // possible to exit ETH with precision less than 1 Gwei. We do not populate `sharesToExit` if the\n        // Eigen Pod shares are not greater than 0.\n        int256 eigenPodShares = delegator.getEigenPodShares();\n        if (eigenPodShares > 0) {\n            sharesToExit = uint256(eigenPodShares).reducePrecisionToGwei();\n        }\n    }\n}\n```\n```\nfunction queueETHWithdrawalFromOperatorsForUserSettlement(\n    IRioLRTOperatorRegistry operatorRegistry,\n    uint256 amount\n) internal returns (bytes32 aggregateRoot) {\n    for (uint256 i = 0; i < length; ++i) {\n        address delegator = operatorDepositDeallocations[i].delegator;\n\n        uint256 amountToWithdraw = (i == length - 1)\n           ? remainingAmount\n            : operatorDepositDeallocations[i].deposits * ETH_DEPOSIT_SIZE;\n\n        remainingAmount -= amountToWithdraw;\n        roots[i] = IRioLRTOperatorDelegator(delegator).queueWithdrawalForUserSettlement(\n            BEACON_CHAIN_STRATEGY,\n            amountToWithdraw\n        );\n    }\n}\n```\n```\nfunction scrapeExcessFullWithdrawalETHFromEigenPod() external {\n    uint256 ethWithdrawable = eigenPod.withdrawableRestakedExecutionLayerGwei().toWei();\n    uint256 ethQueuedForWithdrawal = getETHQueuedForWithdrawal();\n    if (ethWithdrawable <= ethQueuedForWithdrawal + MIN_EXCESS_FULL_WITHDRAWAL_ETH_FOR_SCRAPE) {\n        revert INSUFFICIENT_EXCESS_FULL_WITHDRAWAL_ETH();\n    }\n    _queueWithdrawalForOperatorExitOrScrape(BEACON_CHAIN_STRATEGY, ethWithdrawable - ethQueuedForWithdrawal);\n}\n```\n```\nfunction test_StuckEther() public {\n    uint8 operatorId = addOperatorDelegator(reETH.operatorRegistry, address(reETH.rewardDistributor));\n    address operatorDelegator = reETH.operatorRegistry.getOperatorDetails(operatorId).delegator;\n\n    uint256 TVL = 64 ether;\n    uint256 WITHDRAWAL_AMOUNT = 63 ether;\n    RioLRTOperatorDelegator delegatorContract = RioLRTOperatorDelegator(payable(operatorDelegator));\n\n    // Allocate ETH.\n    reETH.coordinator.depositETH{value: TVL - address(reETH.depositPool).balance}();\n\n    // Push funds into EigenLayer.\n    vm.prank(EOA, EOA);\n    reETH.coordinator.rebalance(ETH_ADDRESS);\n\n    // Verify validator withdrawal credentials.\n    uint40[] memory validatorIndices = verifyCredentialsForValidators(reETH.operatorRegistry, operatorId, 2);\n\n    // Verify and process two full validator exits.\n    verifyAndProcessWithdrawalsForValidatorIndexes(operatorDelegator, validatorIndices);\n\n    // Withdraw some funds.\n    reETH.coordinator.requestWithdrawal(ETH_ADDRESS, WITHDRAWAL_AMOUNT);\n    uint256 withdrawalEpoch = reETH.withdrawalQueue.getCurrentEpoch(ETH_ADDRESS);\n\n    // Skip ahead and rebalance to queue the withdrawal within EigenLayer.\n    skip(reETH.coordinator.rebalanceDelay());\n\n    vm.prank(EOA, EOA);\n    reETH.coordinator.rebalance(ETH_ADDRESS);\n\n    // Verify and process two full validator exits.\n    verifyAndProcessWithdrawalsForValidatorIndexes(operatorDelegator, validatorIndices);\n\n    // Settle with withdrawal epoch.\n    IDelegationManager.Withdrawal[] memory withdrawals = new IDelegationManager.Withdrawal[](1);\n    withdrawals[0] = IDelegationManager.Withdrawal({\n        staker: operatorDelegator,\n        delegatedTo: address(1),\n        withdrawer: address(reETH.withdrawalQueue),\n        nonce: 0,\n        startBlock: 1,\n        strategies: BEACON_CHAIN_STRATEGY.toArray(),\n        shares: WITHDRAWAL_AMOUNT.toArray()\n    });\n    reETH.withdrawalQueue.settleEpochFromEigenLayer(ETH_ADDRESS, withdrawalEpoch, withdrawals, new uint256[](1));\n\n    vm.expectRevert(bytes4(keccak256("INSUFFICIENT_EXCESS_FULL_WITHDRAWAL_ETH()")));\n    delegatorContract.scrapeExcessFullWithdrawalETHFromEigenPod();\n}\n```