Submitted by 0xDjango, also found by BowTiedWardens, cccz, hansfriese, Metatron, shung, ych18, and zzzitron
Staking.setCurvePool() allows the owner to set a new CURVE_POOL address, however, there is no way to set token approvals to the new address. The only calls to token.approve() are found in the constructor. Therefore, theres no true way to set a new curve pool. All calls to ICurvePool(CURVE_POOL).exchange() will fail.
Set approvals for the new curve pool address in the same setCurvePool() function.
0xean (Yieldy) acknowledged 
