Submitted by cmichel, also found by gzeon
LiquidityProviders.sol#L171
Owners can change the liquidityPool variable any time with the setLiquidityPool function.
If a liquidity pool was already set and users added liquidity with addTokenLiquidity, the tokens are directly transferred to the liquidity pool and not kept in the LiquidityProviders contract.
Changing the liquidityPool to a different contract will make it impossible for the users to withdraw their liquidity using removeLiquidity because the tokens are still in the old liquidityPool and cannot be retrieved.
All users will lose their funds.
Changing the liquidityPool requires a sophisticated migration mechanism.
Only allow setting the liquidityPool contract once.
ankurdubey521 (Biconomy) acknowledged
pauliax (judge) decreased severity to Medium and commented:
