MEDIUM severity: The vulnerability lies in the handling of strategy caps in the LSR (Liquidity Source Registry) syste. The vulnerability lies in the handling of strategy caps in the LSR (Liquidity Source Registry) system. Specifically, when an operator's strategy cap is set to "0" or removed, the system fails to update the total shares held and the withdrawal queue accordingly. This allows for a scenario where users...

Vulnerable code:
```\nfunction setOperatorStrategyCap(\n        RioLRTOperatorRegistryStorageV1.StorageV1 storage s,\n        uint8 operatorId,\n        IRioLRTOperatorRegistry.StrategyShareCap memory newShareCap\n    ) internal {\n    if (currentShareDetails.cap > 0 && newShareCap.cap == 0) {\n        if (currentShareDetails.allocation > 0) {\n            operatorDetails.queueOperatorStrategyExit(operatorId, newShareCap.strategy);\n        }\n        utilizationHeap.removeByID(operatorId);\n    } else if (currentShareDetails.cap == 0 && newShareCap.cap > 0) {\n        utilizationHeap.insert(OperatorUtilizationHeap.Operator(operatorId, 0));\n    } else {\n        utilizationHeap.updateUtilizationByID(operatorId, currentShareDetails.allocation.divWad(newShareCap.cap));\n    }\n}\n```\n```\nfunction queueOperatorStrategyExit(\n    IRioLRTOperatorRegistry.OperatorDetails storage operator,\n    uint8 operatorId,\n    address strategy\n) internal {\n    // @review asks delegator to exit\n    bytes32 withdrawalRoot = delegator.queueWithdrawalForOperatorExit(strategy, sharesToExit);\n    emit IRioLRTOperatorRegistry.OperatorStrategyExitQueued(operatorId, strategy, sharesToExit, withdrawalRoot);\n}\n```\n```\nfunction _queueWithdrawalForOperatorExitOrScrape(address strategy, uint256 shares) internal returns (bytes32 root) {\n    root = _queueWithdrawal(strategy, shares, address(depositPool()));\n}\n\nfunction _queueWithdrawal(address strategy, uint256 shares, address withdrawer) internal returns (bytes32 root) {\n    IDelegationManager.QueuedWithdrawalParams[] memory withdrawalParams = new IDelegationManager.QueuedWithdrawalParams[](1);\n    withdrawalParams[0] = IDelegationManager.QueuedWithdrawalParams({\n        strategies: strategy.toArray(),\n        shares: shares.toArray(),\n        withdrawer: withdrawer\n    });\n    root = delegationManager.queueWithdrawals(withdrawalParams)[0];\n}\n```\n```\nfunction test_SettingStrategyCapZero_WithdrawalsAreDoubleCountable() public {\n    IRioLRTOperatorRegistry.StrategyShareCap[] memory zeroStrategyShareCaps = new IRioLRTOperatorRegistry.StrategyShareCap[](2);\n    zeroStrategyShareCaps[0] = IRioLRTOperatorRegistry.StrategyShareCap({strategy: RETH_STRATEGY, cap: 0});\n    zeroStrategyShareCaps[1] = IRioLRTOperatorRegistry.StrategyShareCap({strategy: CBETH_STRATEGY, cap: 0});\n\n    uint8 operatorId = addOperatorDelegator(reLST.operatorRegistry, address(reLST.rewardDistributor));\n\n    uint256 AMOUNT = 111e18;\n\n    cbETH.approve(address(reLST.coordinator), type(uint256).max);\n    uint256 lrtAmount = reLST.coordinator.deposit(CBETH_ADDRESS, AMOUNT);\n\n    vm.prank(EOA, EOA);\n    reLST.coordinator.rebalance(CBETH_ADDRESS);\n\n    vm.recordLogs();\n    reLST.operatorRegistry.setOperatorStrategyShareCaps(operatorId, zeroStrategyShareCaps);\n\n    Vm.Log[] memory entries = vm.getRecordedLogs();\n    assertGt(entries.length, 0);\n\n    for (uint256 i = 0; i < entries.length; i++) {\n        if (entries[i].topics[0] == keccak256('OperatorStrategyExitQueued(uint8,address,uint256,bytes32)')) {\n            uint8 emittedOperatorId = abi.decode(abi.encodePacked(entries[i].topics[1]), (uint8));\n            (address strategy, uint256 sharesToExit, bytes32 withdrawalRoot) = \n                abi.decode(entries[i].data, (address, uint256, bytes32));\n\n            assertEq(emittedOperatorId, operatorId);\n            assertEq(strategy, CBETH_STRATEGY);\n            assertEq(sharesToExit, AMOUNT);\n            assertNotEq(withdrawalRoot, bytes32(0));\n\n            break;\n        }\n        if (i == entries.length - 1) fail('Event not found');\n    }\n\n    uint256 queuedShares = reLST.coordinator.requestWithdrawal(address(cbETH), lrtAmount);\n    console.log("Queued shares", queuedShares);\n}\n```