The setPool() function in PortfolioToken grants unlimited token spending approval to pool contracts, creating a critical security vulnerability. When initializing a pool, the contract approves the ...