Submitted by pauliax
Contract AaveV2 does not cache the lending pool, it retrieves it when necessary by calling a function getLp(). This is great as the implementation may change, however, this contract also approves an unlimited amount of want in the constructor:
For reference, function setLendingPoolImpl.
Not sure how likely is that lending pool implementation will change so marking this as Low.
Recommend that before calling lp.deposit check that the approval is sufficient and increase otherwise.
Evert0x (Sherlock) confirmed
