Submitted by said, also found by pep7siup, oakcobalt (1, 2), Jeiwan, SpicyMeatball, jesusrod15, giovannidisiena, HChang26, and 3docSec
https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/RangeManager.sol#L95-L102 
https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/TokenisableRange.sol#L134-L163
After the owner of RangeManager create new range via generateRange, they can then call initRange to init the range and providing the initial underlying tokens for initial uniswap v3 mint amounts. However, after operation the refunded underlying tokens is not send back to the owner, this will allow user to steal this token by triggering cleanup().
Consider to add cleanup after the initRange call :
Keref (Good Entry) confirmed, but disagreed with severity and commented:
Keref (Good Entry) commented:
gzeon (Judge) decreased severity to Medium and commented:
Good Entry Mitigated:
Status: Mitigation confirmed. Full details in reports from kutugu, xuwinnie and 3docSec.
