Submitted by toastedsteaksandwich, also found by Omik, ScopeLift, bitbopper, pedroais, gzeon, Meta0xNull, and wuwe1
The Locke.arbitraryCall() function allows the inherited governance contract to perform arbitrary contract calls within certain constraints. Contract calls to tokens provided as incentives through the createIncentive() function are not allowed if there is some still some balance according to the incentives mapping (See line 735 referenced below).
However, the token can still be called prior any user creating an incentive, so its possible for the arbitraryCall() function to be used to set an allowance on an incentive token before the contract has actually received any of the token through createIncentive().
In summary:
https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L735
Limit the types of incentive tokens so it can be checked that its not the target contract for the arbitraryCall().
Validate that the allowance of the target contract (if available) has not changed.
brockelmore (Streaming Protocol) confirmed
