quit functions inside Forked DAO should only work for escrowed nouns token from original DAO, otherwise forked DAO will not serve its purpose and auctioned token could be used to get profit from treasury funds
Audit: 2023-07-nounsdao-findings
Severity: MEDIUM

# Lines of code

https://github.com/nounsDAO/nouns-monorepo/blob/718211e063d511eeda1084710f6a682955e80dcb/packages/nouns-contracts/contracts/governance/fork/newdao/governance/NounsDAOLogicV1Fork.sol#L202-L204
https://github.com/nounsDAO/nouns-monorepo/blob/718211e063d511eeda1084710f6a682955e80dcb/packages/nouns-contracts/contracts/governance/fork/newdao/governance/NounsDAOLogicV1Fork.sol#L206-L213


# Vulnerability details

## Impact
`quit` functions purpose is to allows token holders to quit the DAO, taking their pro rata funds from the previous original DAO. But this function not restricted to escrowed token and user that join fork from original DAO. This could make the new forked DAO not serve its purpose, due to funds can be transferred and managed outside of proposal lifecycle, and auction become gameable for profit. 

## Proof of Concept

The `quit` functions inside `NounsDAOLogicV1Fork` currently not restrict provided forked nouns tokens come from original DAO :

https://github.com/nounsDAO/nouns-monorepo/blob/718211e063d511eeda1084710f6a682955e80dcb/packages/nouns-contracts/contracts/governance/fork/newdao/governance/NounsDAOLogicV1Fork.sol#L202-L216

```solidity
    function quit(uint256[] calldata tokenIds) external nonReentrant {
        quitInternal(tokenIds, erc20TokensToIncludeInQuit);
    }

    function quit(uint256[] calldata tokenIds, address[] memory erc20TokensToInclude) external nonReentrant {
        // check that erc20TokensToInclude is a subset of `erc20TokensToIncludeInQuit`
        address[] memory erc20TokensToIncludeInQuit_ = erc20TokensToIncludeInQuit;
        for (uint256 i = 0; i < erc20TokensToInclude.length; i++) {
            if (!isAddressIn(erc20TokensToInclude[i], erc20TokensToIncludeInQuit_)) {
                revert TokensMustBeASubsetOfWhitelistedTokens();
            }
        }

        quitInternal(tokenIds, erc20TokensToInclude);
    }
```

as long as fork time is completed, passed the governance delay or all tokens from original DAO claimed, everyone can call `quit` even using newly minted token from forked DAO auction.

This can cause issue, consider this scenario :

1. Current nouns token total supply and config parameters of initial V3 :

nouns total supply : 776 
fork threshold : 20 %
eth treasury : 13000 ether and 14000 stETH
threshold for fork : 156 (20% of 776)

2. 157 nouns token total is escrowed to fork not for financial purpose but to run new DAO (they won't withdraw and quit from the new forked DAO). The funds from original DAO will be send to fork treasury, proportional to the `tokensInEscrow` out of total supply : 

https://github.com/nounsDAO/nouns-monorepo/blob/718211e063d511eeda1084710f6a682955e80dcb/packages/nouns-contracts/contracts/governance/fork/NounsDAOV3Fork.sol#L124

```solidity
    function executeFork(NounsDAOStorageV3.StorageV3 storage ds)
        external
        returns (address forkTreasury, address forkToken)
    {
        if (isForkPeriodActive(ds)) revert ForkPeriodAct