Vulnerability: ERC5095 has not approved MarketPlace to spend tokens in ERC5095
Severity: medium

Description:
ERC5095 requires approving MarketPlace to spend the tokens in ERC5095 before calling MarketPlace.sellUnderlying/sellPrincipalToken\\nMarketPlace.sellUnderlying/sellPrincipalToken will call transferFrom to send tokens from msg.sender to pool, which requires msg.sender to approve MarketPlace. However, before calling MarketPlace.sellUnderlying/sellPrincipalToken in ERC5095, there is no approval for MarketPlace to spend the tokens in ERC5095, which causes functions such as ERC5095.deposit/mint/withdraw/redeem functions fail, i.e. users cannot sell tokens through ERC5095.\\n```\\n    function sellUnderlying(\\n        address u,\\n        uint256 m,\\n        uint128 a,\\n        uint128 s\\n    ) external returns (uint128) {\\n        // Get the pool for the market\\n        IPool pool = IPool(pools[u][m]);\\n\\n        // Get the number of PTs received for selling `a` underlying tokens\\n        uint128 expected = pool.sellBasePreview(a);\\n\\n        // Verify slippage does not exceed the one set by the user\\n        if (expected < s) {\\n            revert Exception(16, expected, 0, address(0), address(0));\\n        }\\n\\n        // Transfer the underlying tokens to the pool\\n        Safe.transferFrom(IERC20(pool.base()), msg.sender, address(pool), a);\\n// rest of code\\n    function sellPrincipalToken(\\n        address u,\\n        uint256 m,\\n        uint128 a,\\n        uint128 s\\n    ) external returns (uint128) {\\n        // Get the pool for the market\\n        IPool pool = IPool(pools[u][m]);\\n\\n        // Preview amount of underlying received by selling `a` PTs\\n        uint256 expected = pool.sellFYTokenPreview(a);\\n\\n        // Verify that the amount needed does not exceed the slippage parameter\\n        if (expected < s) {\\n            revert Exception(16, expected, s, address(0), address(0));\\n        }\\n\\n        // Transfer the principal tokens to the pool\\n        Safe.transferFrom(\\n            IERC20(address(pool.fyToken())),\\n            msg.sender,\\n            address(pool),\\n            a\\n        );\\n```\\n\\nIn the test file, `vm.startPrank(address(token))` is used and approves the MarketPlace, which cannot be done in the mainnet\\n```\\n        vm.startPrank(address(token));\\n        IERC20(Contracts.USDC).approve(address(marketplace), type(uint256).max);\\n        IERC20(Contracts.YIELD_TOKEN).approve(\\n            address(marketplace),\\n            type(uint256).max\\n        );\\n```\\n

Impact:
It makes functions such as ERC5095.deposit/mint/withdraw/redeem functions fail, i.e. users cannot sell tokens through ERC5095.

Recommended mitigation:
Approve MarketPlace to spend tokens in ERC5095 in ERC5095.setPool.\\n```\\n    function setPool(address p)\\n        external\\n        authorized(marketplace)\\n        returns (bool)\\n    {\\n        pool = p.fyToken();\\n// Add the line below\\n      Safe.approve(IERC20(underlying), marketplace, type(uint256).max);\\n// Add the line below\\n      Safe.approve(IERC20(p.), marketplace, type(uint256).max);\\n\\n        return true;\\n    }\\n\\n        pool = address(0);\\n    }\\n```\\n