During NativeVault deployment, insufficient validation of the `extraData` parameter allows for the theft of staker funds and prevention of the vault slashing.
Audit: 2024-07-karak-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/Core.sol#L161-L168
https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/entities/CoreLib.sol#L118-L147
https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/entities/CoreLib.sol#L89-L116
https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/NativeVault.sol#L46-L79


# Vulnerability details

## Bug description
In order for an operator to deploy a new restaking vault, he must call `Core::deployVaults()`, passing in configuration of the vault and the implementation to use as the parameters.

The function calls the `CoreLib::deployVaults()` passing in parameters supplied by the operator.

[Core.sol#L167](https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/Core.sol#L167)
```solidity
vaults = _self().deployVaults(msg.sender, vaultImpl, vaultConfigs);
```

`deployVaults()` function of the `CoreLib` library will validate that the implementation and underlying tokens are allowlisted in the system and then will call `createVault()` function.


[CoreLib.sol#L77-L87](https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/entities/CoreLib.sol#L77-L87)
```solidity
function validateVaultConfigs(
    Storage storage self,
    VaultLib.Config[] calldata vaultConfigs,
    address implementation
) public view {
    if (
        !(implementation == address(0) ||
            isVaultImplAllowlisted(self, implementation))
    ) {
        revert VaultImplNotAllowlisted();
    }
    for (uint256 i = 0; i < vaultConfigs.length; i++) {
        if (self.assetSlashingHandlers[vaultConfigs[i].asset] == address(0))
            revert AssetNotAllowlisted();
    }
}
```
After cloning a vault, `createVault()` function will  initialize it.

[CoreLib.sol#L89-L116](https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/entities/CoreLib.sol#L89-L116)
```solidity
IKarakBaseVault vault = cloneVault(salt);
vault.initialize(
    address(this),
    operator,
    depositToken,
    name,
    symbol,
    extraData
);
```

As can be seen, the `extraData` parameter is not validated, thus an operator creating a new vault can pass any arbitrary values. This is problematic, because during NativeVault's initialization, `extraData` parameter is used to set the value of the `manager`, `slashStore` and the `nodeImplementation` in the NativeVault.

[NativeVault.sol#L46-L79](https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/NativeVault.sol#L46-L79)
```solidity
(address manager, address slashStore, address nodeImplementation) = abi
    .decode(_extraData, (address, address, address));
if (
    manager == address(0) ||
    slashStore == address(0) ||
    nodeImplementation == address(0)
) revert ZeroAddress();
_gran