Submitted by 0xpiken, also found by Rhaydden, hash, and pkqs90
The failure of permit signature verification might revert the whole function.
PositionAction#increaseLever() might revert if ERC20 permit signature is used as permitParams
The IERC20Permit(token).safePermit() call is supposed to allow spender to spend up to approvalAmount of token on behalf of from. The spender in _transferFrom() should be the contract itself:
However, IERC20Permit(token).safePermit() use to as spender to verify the permit signature.  The safePermit() call will be reverted if to is not same as the contract itself.
Copy below codes to PositionAction20.t.sol and run forge test --match-test test_increaseLeverWithInvalidPermission:
Use address(this) as spender for safePermit():
Context
amarcu (Loopfi) confirmed
Infect3d (warden) commented:
pkqs90 (warden) commented:
Koolex (judge) commented:
