`depositYBLendSGLLockXchainTOLP` function of the MagnetarAssetXChainModule will not work because it transfers Singularity tokens to the user before `_withdrawToChain`
Audit: 2024-02-tapioca-findings
Severity: MEDIUM

# Lines of code

https://github.com/Tapioca-DAO/tapioca-periph/blob/032396f701be935b04a7e5cf3cb40a0136259dbc/contracts/Magnetar/modules/MagnetarAssetXChainModule.sol#L85-L114
https://github.com/Tapioca-DAO/tapioca-periph/blob/032396f701be935b04a7e5cf3cb40a0136259dbc/contracts/Magnetar/modules/MagnetarAssetCommonModule.sol#L52-L63


# Vulnerability details

## Description
In `depositYBLendSGLLockXchainTOLP` function of the MagnetarAssetXChainModule, after lending to SGL, it will wrap the received Singularity tokens into the TOFT wrapping token of it. Afterward, it attempts to transfer those wrapped tokens cross-chain, then unwrap them in the destination chain to lock + participate
```solidity=
function depositYBLendSGLLockXchainTOLP(DepositAndSendForLockingData memory data) public payable {
    ...
    uint256 fraction =
        _depositYBLendSGL(data.depositData, data.singularity, IYieldBox(yieldBox), data.user, data.lendAmount);

    // wrap SGL receipt into tReceipt
    // ! User should approve `address(this)` for `IERC20(data.singularity)` !
    uint256 toftAmount = _wrapSglReceipt(IYieldBox(yieldBox), data.singularity, data.user, fraction, data.assetId);

    data.lockAndParticipateSendParams.lzParams.sendParam.amountLD = toftAmount;

    // decode `composeMsg` and re-encode it with updated params
    (uint16 msgType_,, uint16 msgIndex_, bytes memory tapComposeMsg_, bytes memory nextMsg_) =
    TapiocaOmnichainEngineCodec.decodeToeComposeMsg(data.lockAndParticipateSendParams.lzParams.sendParam.composeMsg);

    LockAndParticipateData memory lockData = abi.decode(tapComposeMsg_, (LockAndParticipateData));
    lockData.fraction = toftAmount;

    data.lockAndParticipateSendParams.lzParams.sendParam.composeMsg =
        TapiocaOmnichainEngineCodec.encodeToeComposeMsg(abi.encode(lockData), msgType_, msgIndex_, nextMsg_);

    // send on another layer for lending
    _withdrawToChain(
        MagnetarWithdrawData({
            yieldBox: yieldBox,
            assetId: data.assetId,
            unwrap: false,
            lzSendParams: data.lockAndParticipateSendParams.lzParams,
            sendGas: data.lockAndParticipateSendParams.lzSendGas,
            composeGas: data.lockAndParticipateSendParams.lzComposeGas,
            sendVal: data.lockAndParticipateSendParams.lzSendVal,
            composeVal: data.lockAndParticipateSendParams.lzComposeVal,
            composeMsg: data.lockAndParticipateSendParams.lzParams.sendParam.composeMsg,
            composeMsgType: data.lockAndParticipateSendParams.lzComposeMsgType,
            withdraw: true
        })
    );
}
```
After lending into the Singularity contract, `_wrapSglReceipt` is used to wrap the received Singularity tokens into TOFT tokens. Thus, they will be able to be sent cross-chain by using `_withdrawToChain` with composed messages including the `lockAndParticipate` option to perform these actions after receiving tokens

The `_withdrawToChain` function attempts to withdraw YieldBox shares of th