According to the ReadMe, 
The failure to revoke the position manager permit after each operation leaves users CDPs vulnerable to unauthorized access. This breaks the main security invariant and could potentially allow the ZapRouter contract or malicious actors to manipulate users positions without their consent in subsequent transactions.
In the ZapRouterBase.sol contract, theres a function to grant the position manager permit:
https://github.com/code-423n4/2024-06-badger/blob/9173558ee1ac8a78a7ae0a39b97b50ff0dd9e0f8/ebtc-zap-router/src/ZapRouterBase.sol#L115-L133
However, there is no corresponding function or mechanism to revoke this permit after the operation is completed. This means that once granted, the ZapRouter contract still retains the ability to manage the users CDP beyond the intended single operation.
In LeverageZapRouterBase.sol, operations like _adjustCdpOperation, _openCdpOperation, and _closeCdpOperation use these permissions but do not revoke them afterward:
As we observe, this pattern is consistent across all CDP operations, leaving the permit active after each transaction.
Implement a function to revoke the position manager permit immediately after each CDP operation is completed, and ensure its called at the end of every relevant function.
