Submitted by cmichel, also found by gzeon
LiquidityProviders.sol#L116
Owners can change the lpToken variable at any time with the setLpToken function.
If an LP token was already set and users added liquidity with addTokenLiquidity and were minted a lpToken NFT, changing the lpToken to a different contract will make it impossible for the users to withdraw their liquidity using removeLiquidity.
All users will lose their funds.
Changing the lpToken requires a sophisticated migration mechanism.
Only allow setting the lpToken contract once.
ankurdubey521 (Biconomy) acknowledged
pauliax (judge) decreased severity to Medium and commented:
