The Pool.lockUnits allows anyone to steal pool tokens from a member and assign them to msg.sender. Anyone can steal pool tokens from any other user.
Recommend adding access control and require that msg.sender is the router or another authorized party.
strictly-scarce (vader) confirmed:
