MEDIUM severity: The vulnerability lies in the `PaymentOutputToPaymentTxCondition` abstraction, which is responsible . The vulnerability lies in the `PaymentOutputToPaymentTxCondition` abstraction, which is responsible for verifying the spending condition of transactions. Specifically, the abstraction allows "v2 transactions" to exit using the `PaymentExitGame` contract, even though they are not intended to be used...

Vulnerable code:
```\nfunction verify(\n    bytes calldata inputTxBytes,\n    uint16 outputIndex,\n    uint256 inputTxPos,\n    bytes calldata spendingTxBytes,\n    uint16 inputIndex,\n    bytes calldata signature\n)\n    external\n    view\n    returns (bool)\n{\n    PaymentTransactionModel.Transaction memory inputTx = PaymentTransactionModel.decode(inputTxBytes);\n    require(inputTx.txType == supportInputTxType, "Input tx is an unsupported payment tx type");\n\n    PaymentTransactionModel.Transaction memory spendingTx = PaymentTransactionModel.decode(spendingTxBytes);\n    require(spendingTx.txType == supportSpendingTxType, "The spending tx is an unsupported payment tx type");\n\n    UtxoPosLib.UtxoPos memory utxoPos = UtxoPosLib.build(\n        TxPosLib.TxPos(inputTxPos),\n        outputIndex\n    );\n    require(\n        spendingTx.inputs[inputIndex] == bytes32(utxoPos.value),\n        "Spending tx points to the incorrect output UTXO position"\n    );\n\n    address payable owner = inputTx.outputs[outputIndex].owner();\n    require(\n        owner == ECDSA.recover(eip712.hashTx(spendingTx), signature),\n        "Tx in not signed correctly"\n    );\n\n    return true;\n}\n```\n```\n/**\n * @notice Registers an exit game within the PlasmaFramework. Only the maintainer can call the function.\n * @dev Emits ExitGameRegistered event to notify clients\n * @param _txType The tx type where the exit game wants to register\n * @param _contract Address of the exit game contract\n * @param _protocol The transaction protocol, either 1 for MVP or 2 for MoreVP\n */\nfunction registerExitGame(uint256 _txType, address _contract, uint8 _protocol) public onlyFrom(getMaintainer()) {\n    require(_txType!= 0, "Should not register with tx type 0");\n    require(_contract!= address(0), "Should not register with an empty exit game address");\n    require(_exitGames[_txType] == address(0), "The tx type is already registered");\n    require(_exitGameToTxType[_contract] == 0, "The exit game contract is already registered");\n    require(Protocol.isValidProtocol(_protocol), "Invalid protocol value");\n\n    _exitGames[_txType] = _contract;\n    _exitGameToTxType[_contract] = _txType;\n    _protocols[_txType] = _protocol;\n    _exitGameQuarantine.quarantine(_contract);\n\n    emit ExitGameRegistered(_txType, _contract, _protocol);\n}\n```\n```\nawait deployer.deploy(\n    PaymentOutputToPaymentTxCondition,\n    plasmaFramework.address,\n    PAYMENT_OUTPUT_TYPE,\n    PAYMENT_TX_TYPE,\n);\n\nconst paymentToPaymentCondition = await PaymentOutputToPaymentTxCondition.deployed();\n\nawait deployer.deploy(\n    PaymentOutputToPaymentTxCondition,\n    plasmaFramework.address,\n    PAYMENT_OUTPUT_TYPE,\n    PAYMENT_V2_TX_TYPE,\n);\n\nconst paymentToPaymentV2Condition = await PaymentOutputToPaymentTxCondition.deployed();\n```\n```\nconsole.log(`Registering paymentToPaymentCondition (${paymentToPaymentCondition.address}) to spendingConditionRegistry`);\nawait spendingConditionRegistry.registerSpendingCondition(\n  PAYMENT_OUTPUT_TYPE,\n  PAYMENT_TX_TYPE,\n  paymentToPaymentCondition.address,\n);\n\nconsole.log(`Registering paymentToPaymentV2Condition (${paymentToPaymentV2Condition.address}) to spendingConditionRegistry`);\nawait spendingConditionRegistry.registerSpendingCondition(\n  PAYMENT_OUTPUT_TYPE,\n  PAYMENT_V2_TX_TYPE,\n  paymentToPaymentV2Condition.address,\n);\n\nawait spendingConditionRegistry.renounceOwnership();\n```\n```\nawait plasmaFramework.registerExitGame(\n    PAYMENT_TX_TYPE,\n    paymentExitGame.address,\n    config.frameworks.protocols.moreVp,\n    { from: maintainerAddress }\n);\n```\n```\n/**\n * @notice Registers an exit game within the PlasmaFramework. Only the maintainer can call the function.\n * @dev Emits ExitGameRegistered event to notify clients\n * @param _txType The tx type where the exit game wants to register\n * @param _contract Address of the exit game contract\n * @param _protocol The transaction protocol, either 1 for MVP or 2 for MoreVP\n */\nfunction registerExitGame(uint256 _txType, address _contract, uint8 _protocol) public onlyFrom(getMaintainer()) {\n    require(_txType!= 0, "Should not register with tx type 0");\n    require(_contract!= address(0), "Should not register with an empty exit game address");\n    require(_exitGames[_txType] == address(0), "The tx type is already registered");\n    require(_exitGameToTxType[_contract] == 0, "The exit game contract is already registered");\n    require(Protocol.isValidProtocol(_protocol), "Invalid protocol value");\n\n    _exitGames[_txType] = _contract;\n    _exitGameToTxType[_contract] = _txType;\n    _protocols[_txType] = _protocol;\n    _exitGameQuarantine.quarantine(_contract);\n\n    emit ExitGameRegistered(_txType, _contract, _protocol);\n}\n```