Vulnerability: Misleading intentional misconfiguration possible through misuse of newToken and newBaseInstance
Severity: medium

Description:
The instantiation process for a Dandelion organization requires two separate external calls to `DandelionOrg`. There are two primary functions: `installDandelionApps`, and `newTokenAndBaseInstance`.\\n`installDandelionApps` relies on cached results from prior calls to `newTokenAndBaseInstance` and completes the initialization step for a Dandelion org.\\n`newTokenAndBaseInstance` is a wrapper around two publicly accessible functions: `newToken` and `newBaseInstance`. Called together, the functions:\\nDeploy a new `MiniMeToken` used to represent shares in an organization, and cache the address of the created token:\\n```\\n/\\*\\*\\n\\* @dev Create a new MiniMe token and save it for the user\\n\\* @param \\_name String with the name for the token used by share holders in the organization\\n\\* @param \\_symbol String with the symbol for the token used by share holders in the organization\\n\\*/\\nfunction newToken(string memory \\_name, string memory \\_symbol) public returns (MiniMeToken) {\\n    MiniMeToken token = \\_createToken(\\_name, \\_symbol, TOKEN\\_DECIMALS);\\n    \\_saveToken(token);\\n    return token;\\n}\\n```\\n\\nCreate a new dao instance using Aragon's `BaseTemplate` contract:\\n```\\n/\\*\\*\\n\\* @dev Deploy a Dandelion Org DAO using a previously saved MiniMe token\\n\\* @param \\_id String with the name for org, will assign `[id].aragonid.eth`\\n\\* @param \\_holders Array of token holder addresses\\n\\* @param \\_stakes Array of token stakes for holders (token has 18 decimals, multiply token amount `\\* 10^18`)\\n\\* @param \\_useAgentAsVault Boolean to tell whether to use an Agent app as a more advanced form of Vault app\\n\\*/\\nfunction newBaseInstance(\\n    string memory \\_id,\\n    address[] memory \\_holders,\\n    uint256[] memory \\_stakes,\\n    uint64 \\_financePeriod,\\n    bool \\_useAgentAsVault\\n)\\n    public\\n{\\n    \\_validateId(\\_id);\\n    \\_ensureBaseSettings(\\_holders, \\_stakes);\\n\\n    (Kernel dao, ACL acl) = \\_createDAO();\\n    \\_setupBaseApps(dao, acl, \\_holders, \\_stakes, \\_financePeriod, \\_useAgentAsVault);\\n}\\n```\\n\\nSet up prepackaged Aragon apps, like `Vault`, `TokenManager`, and Finance:\\n```\\nfunction \\_setupBaseApps(\\n    Kernel \\_dao,\\n    ACL \\_acl,\\n    address[] memory \\_holders,\\n    uint256[] memory \\_stakes,\\n    uint64 \\_financePeriod,\\n    bool \\_useAgentAsVault\\n)\\n    internal\\n{\\n    MiniMeToken token = \\_getToken();\\n    Vault agentOrVault = \\_useAgentAsVault ? \\_installDefaultAgentApp(\\_dao) : \\_installVaultApp(\\_dao);\\n    TokenManager tokenManager = \\_installTokenManagerApp(\\_dao, token, TOKEN\\_TRANSFERABLE, TOKEN\\_MAX\\_PER\\_ACCOUNT);\\n    Finance finance = \\_installFinanceApp(\\_dao, agentOrVault, \\_financePeriod == 0 ? DEFAULT\\_FINANCE\\_PERIOD : \\_financePeriod);\\n\\n    \\_mintTokens(\\_acl, tokenManager, \\_holders, \\_stakes);\\n    \\_saveBaseApps(\\_dao, finance, tokenManager, agentOrVault);\\n    \\_saveAgentAsVault(\\_dao, \\_useAgentAsVault);\\n\\n}\\n```\\n\\nNote that `newToken` and `newBaseInstance` can be called separately. The token created in `newToken` is cached in `_saveToken`, which overwrites any previously-cached value:\\n```\\nfunction \\_saveToken(MiniMeToken \\_token) internal {\\n    DeployedContracts storage senderDeployedContracts = deployedContracts[msg.sender];\\n\\n    senderDeployedContracts.token = address(\\_token);\\n}\\n```\\n\\nCached tokens are retrieved in _getToken:\\n```\\nfunction \\_getToken() internal returns (MiniMeToken) {\\n    DeployedContracts storage senderDeployedContracts = deployedContracts[msg.sender];\\n    require(senderDeployedContracts.token != address(0), ERROR\\_MISSING\\_TOKEN\\_CONTRACT);\\n\\n    MiniMeToken token = MiniMeToken(senderDeployedContracts.token);\\n    return token;\\n}\\n```\\n\\nBy exploiting the overwriteable caching mechanism, it is possible to intentionally misconfigure Dandelion orgs.\\n`installDandelionApps` uses `_getToken` to associate a token with the `DandelionVoting` app. The value returned from `_getToken` depends on the sender's previous call to `newToken`, which overwrites any previously-cached value. The steps for intentional misconfiguration are as follows:\\nSender calls `newTokenAndBaseInstance`, creating token `m0` and DAO `A`.\\nThe `TokenManager` app in `A` is automatically configured to be the controller of `m0`.\\n`m0` is cached using `_saveToken`.\\nDAO `A` apps are cached for future use using `_saveBaseApps` and `_saveAgentAsVault`.\\nSender calls `newToken`, creating token `m1`, and overwriting the cache of `m0`.\\nFuture calls to `_getToken` will retrieve `m1`.\\nThe `DandelionOrg` contract is the controller of `m1`.\\nSender calls `installDandelionApps`, which installs Dandelion apps in DAO `A`\\nThe `DandelionVoting` app is configured to use the current cached token, `m1`, rather than the token associated with `A.TokenManager`, `m0`\\nFurther calls to `newBaseInstance` and `installDandelionApps` create DAO `B`, populate it with Dandelion apps, and assign `B.TokenManager` as the controller of the earlier `DandelionVoting` app token, `m0`.\\nMany different misconfigurations are possible, and some may be underhandedly abusable.

Impact:

Recommended mitigation:
Make `newToken` and `newBaseInstance` internal so they are only callable via `newTokenAndBaseInstance`.