YetiFinanceTreasury.sol#updateTeamWallet() should implement two-step transfer pattern

[code423n4]

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2021-12-yetifinance/blob/5f5bf61209b722ba568623d8446111b1ea5cb61c/packages/contracts/contracts/YetiFinanceTreasury.sol#L28-L30

function updateTeamWallet(address _newTeamWallet) external onlyTeam {
    teamWallet = _newTeamWallet;
}

YetiFinanceTreasury.teamWallet is a critical role, if the current teamWallet mistakenly called updateTeamWallet() with a wrong address, it can result in all the onlyTeam() methods being unaccessible, and it cannot be undo.

Recomandation

Consider changing the updateTeamWallet() function to first nominate an address as the pending teamWallet and adding an acceptTeamWallet() function which is called by the pending teamWallet to confirm the transfer.

[kingyetifinance]

@LilYeti: Duplicate #115

[alcueca]

Taking this as main