Yieldy: After updating curve pool, no more instantUnstakeCurve possible

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Staking.sol#L79-L80
https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Staking.sol#L157-L160

Vulnerability details

Impact

After updating the curve pool using setCurvePool, one cannot use instantUnstakeCurve anymore, because TOKE_POOL is not approved to the new curve pool.
There is no other way to approve, so the instantUnstakeCurve functionality cannot be used with any new curve pool. When no curve pool was set in the initialize function, then there is no way to use the instantUnstakeCurve functionality.

Proof of Concept

This proof of concept demonstrates that the instantUnstakeCurve reverts after the curve pool is updated.
The set up for the proof of concept is almost identical to the test/stakingTest.ts except the curve pool was set to zero in the initialize.
Then the curve pool was updated by calling the setCurvePool function, then attempt to call instantUnstakeCurve, which reverts.

Tools Used

hardhat

Recommended Mitigation Steps

Add the approve logic to the setCurvePool or setToAndFromCurve. Also consider adding logic to un-approve the previous curve pool, just in case the curve pool might be compromised.

[toshiSat]

duplicate #165