https://github.com/code-423n4/2024-07-loopfi/blob/57871f64bdea450c1f04c9a53dc1a78223719164/src/reward/ChefIncentivesController.sol#L430-L433
This function allows the owner to withdraw an arbitrary amount of an arbitrary ERC20 token (tokenAddress) and transfer it to the msg.sender. While this functionality provides flexibility for the owner to recover funds, there is a flaw in how it handles withdrawals of the contracts underlying Token.
QA, since the function is onlyOwner protected. However, since the contracts accounting is likely based on the underlying token, this withdrawal would lead to inconsistencies or incorrect accounting records.
Modify the recoverERC20 function to prevent the withdrawal of the underlying token.
