it's not possible to correctly change and update PirexGmx address in AutoPxGlp and AutoPxGmx contracts because setPlatform() don't set spending approval for new address
Audit: 2022-11-redactedcartel-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/vaults/AutoPxGlp.sol#L126-L136
https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/vaults/AutoPxGmx.sol#L148-L158


# Vulnerability details

## Impact
Function `setPlatform()` in `AutoPxGlp` and `AutoPxGmx` contracts update the `PirexGmx` address but because it doesn't set token(`gmxBaseReward` token for `AutoPxGlp` and `gmx` token for `AutoPxGmx`) spending approval for new address it would cause  `AutoPxGlp` and `AutoPxGmx` to be in a broken state which depositing interaction with `PirexGmx` wouldn't be possible. This would cause `compound()` function to revert and because all the logics call `compound()` so all the logics of `AutoPxGlp` and `AutoPxGmx`  to fail. so if `owner` calls `setPlatform()` then all the funds in the contract would be inaccessible and `owner` should call `setPlatform()` again and set the old address of `PirexGmx` and if this old address was broken then funds would be locked forever. so the impact is:
1. it's not possible to update the address of `PirexGmx`  in `AutoPxGlp` and `AutoPxGmx` if addresses in the protocol has been updated.
2. funds lock forever if the `PirexGmx` was deployed in new address and the contract in the old address of  was broken.

## Proof of Concept
This is the `setPlatform()` code in `AutoPxGlp` and `AutoPxGmx` contracts:
```
    /**
        @notice Set the platform
        @param  _platform  address  Platform
     */
    function setPlatform(address _platform) external onlyOwner {
        if (_platform == address(0)) revert ZeroAddress();

        platform = _platform;

        emit PlatformUpdated(_platform);
    }
```
As you can see it sets the new address but don't give spending approval for the new address and don't set the approval for the old address as zero.
This is the `constructors()` code in `AutoPxGmx`:
```
    constructor(
        address _gmxBaseReward,
        address _gmx,
        address _asset,
        string memory _name,
        string memory _symbol,
        address _platform,
        address _rewardsModule
    ) Owned(msg.sender) PirexERC4626(ERC20(_asset), _name, _symbol) {
        if (_gmxBaseReward == address(0)) revert ZeroAddress();
        if (_gmx == address(0)) revert ZeroAddress();
        if (_asset == address(0)) revert ZeroAddress();
        if (bytes(_name).length == 0) revert InvalidAssetParam();
        if (bytes(_symbol).length == 0) revert InvalidAssetParam();
        if (_platform == address(0)) revert ZeroAddress();
        if (_rewardsModule == address(0)) revert ZeroAddress();

        gmxBaseReward = ERC20(_gmxBaseReward);
        gmx = ERC20(_gmx);
        platform = _platform;
        rewardsModule = _rewardsModule;

        // Approve the Uniswap V3 router to manage our base reward (inbound swap token)
        gmxBaseReward.safeApprove(address(SWAP_ROUTER), type(uint256).max);