Question: Stale RPL approval after vault deposit

[angguntrie3-lgtm]

Hi Rocket Pool team,

I noticed that after a user deposits ETH into the RocketVault, the RPL approval granted in StakingVault remains active even after the deposit completes.

Specifically, in StakingVault.sol:93:

RPL.approve(address(rocketVault), type(uint256).max);

This approval persists after rocketVault.deposit{value: msg.value}() (line 114). While the RPL can currently only be used via withdrawERC20, a stale max approval:

1. Increases attack surface if a new function is added that uses RPL
2. Violates the principle of least privilege

My questions:

1. Is this approval intentionally left active for future use?
2. Would it be valuable to revoke it after deposit completes?

Thanks for clarifying!