Lack of proper validation checks when approving token transfers on behalf of users in the `requestDepositWithPermit` and `requestRedeemWithPermit` functions.
Audit: 2023-09-centrifuge-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/LiquidityPool.sol#L223-L226
https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/LiquidityPool.sol#L240-L242


# Vulnerability details

## Impact

Unauthorized token transfers, can result in financial losses for users of the contract.

## Proof of Concept

There are calls to approve token transfers on behalf of users, which could potentially be exploited by malicious users or contracts. 

In the `requestDepositWithPermit` function, the contract approves token transfers using the `permit` function of an ERC20 token. Malicious users could call this function to approve token transfers without proper authorization.

1. The `requestDepositWithPermit` function: **[L223-225](https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/LiquidityPool.sol#L223-L226)**
   
   ```solidity
   ERC20PermitLike(asset).permit(owner, address(investmentManager), assets, deadline, v, r, s);
   investmentManager.requestDeposit(assets, owner);
   emit DepositRequested(owner, assets);
   ```
   In this code snippet, the `permit` function of the `asset` ERC20 token is called, which can approve token transfers on behalf of the `owner` to the `investmentManager` contract. This function allows users to approve transfers without requiring proper authorization.

The vulnerability arises from the fact that any user or contract can call the `requestDepositWithPermit` function and supply arbitrary `owner`, `assets`, `deadline`, `v`, `r`, and `s` parameters. Here's how the vulnerability can be exploited:

- An attacker deploys a malicious contract and calls the `requestDepositWithPermit` function, passing their own `owner` address, arbitrary `assets` value, and crafted `deadline`, `v`, `r`, and `s` parameters.
- The `permit` function of the `asset` ERC20 token is invoked, approving token transfers on behalf of the specified `owner` to the `investmentManager` contract, all based on the crafted parameters.
- Since the attacker controls the `owner` address, they can approve transfers of tokens they don't own to the `investmentManager` contract without proper authorization.

------------------------------------------------------------------------------------------------------------------------

In the `requestRedeemWithPermit` function, similar to `requestDepositWithPermit`, token approvals are made using the `permit` function.

2. The `requestRedeemWithPermit` function: **[L240-L242](https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/LiquidityPool.sol#L240-L242)**

```solidity
   share.permit(owner, address(investmentManager), shares, deadline, v, r, s);
   investmentManager.requestRedeem(shares, owner);
   emit RedeemRequested(owner, shares);
   ```
   Similar to the previous case, the `permit` function of the `share` ERC20 token is call