https://github.com/code-423n4/2023-10-party/blob/b23c65d62a20921c709582b0b76b387f2bb9ebb5/contracts/crowdfund/InitialETHCrowdfund.sol#L305
With the current implementation of PartyGovernanceNFT, approved addresses have extreme power over the NFTs they are approved for: they can transfer the approved NFTs, but also burn them from rageQuit without owner interaction.
They are, however, not allowed to contribute to them:
Consider allowing approved and approvedForAll addresses to contribute existing NFTs.
