prevent dispatching if validator owner is sanctioned

src/contracts/StakingContract.sol

@@ -274,9 +274,20 @@ contract StakingContract {
 
     /// @notice Retrieve withdrawer of public key root
     /// @notice In case the validator is not enabled, it will return address(0)
+    /// @notice In case the owner of the validator is sanctioned, it will revert
     /// @param _publicKeyRoot Hash of the public key
     function getWithdrawerFromPublicKeyRoot(bytes32 _publicKeyRoot) external view returns (address) {
-        return _getWithdrawer(_publicKeyRoot);
+        address withdrawer = _getWithdrawer(_publicKeyRoot);
+        if (withdrawer == address(0)) {
+            return address(0);
+        }
+        address sanctionsOracle = StakingContractStorageLib.getSanctionsOracle();
+        if (sanctionsOracle != address(0)) {
+            if (ISanctionsOracle(sanctionsOracle).isSanctioned(withdrawer)) {
+                revert AddressSanctioned(withdrawer);
+            }
+        }
+        return withdrawer;
     }
 
     /// @notice Retrieve whether the validator exit has been requested

src/test/StakingContract.t.sol

@@ -3291,4 +3291,33 @@ contract StakingContractBehindProxyTest is Test {
         vm.prank(admin);
         stakingContract.blockAccount(bob, PUBKEY_2);
     }
+
+    error AddressSanctioned(address addr);
+
+    function test_withdraw_from_recipient_owner_sanctioned() public {
+        vm.prank(admin);
+        stakingContract.setSanctionsOracle(address(oracle));
+        assertFalse(oracle.isSanctioned(bob));
+
+        vm.deal(bob, 32 ether);
+
+        vm.prank(bob);
+        stakingContract.deposit{value: 32 ether}();
+
+        address clfr = stakingContract.getCLFeeRecipient(PUBKEY_1);
+        vm.deal(clfr, 1 ether);
+
+        vm.prank(bob);
+        // First withdrawal deploy the recipient such that afterwards it's possible to trigger
+        // the withdrawal from the recipient directly
+        stakingContract.withdrawCLFee(PUBKEY_1);
+
+        oracle.setSanction(bob, true);
+
+        vm.deal(clfr, 1 ether);
+
+        vm.prank(bob);
+        vm.expectRevert(abi.encodeWithSignature("AddressSanctioned(address)", bob));
+        IFeeRecipient(clfr).withdraw();
+    }
 }