Liquidators can be tricked to operate with LiquidationPairs that were deployed using the LiquidationPairFactory but they configured the LiquidationSource as a fake malicious contract
Audit: 2023-08-pooltogether-findings
Severity: MEDIUM

# Lines of code

https://github.com/GenerationSoftware/pt-v5-cgda-liquidator/blob/7f95bcacd4a566c2becb98d55c1886cadbaa8897/src/LiquidationPairFactory.sol#L65-L108


# Vulnerability details

## Impact
- Users and Bots can be tricked into operating with LiquidationPairs that were deployed using the LiquidationPairFactory but they configured the LiquidationSource as a fake malicious contract that will allow the Liquidator's creator to steal all the POOL tokens that were meant to be used to liquidate the Vault's Yield

## Proof of Concept
- The current implementation of the [`LiquidationPairFactory::createPair()`](https://github.com/GenerationSoftware/pt-v5-cgda-liquidator/blob/7f95bcacd4a566c2becb98d55c1886cadbaa8897/src/LiquidationPairFactory.sol#L65-L108) allows the callers to set the LiquidationSource as any arbitrary address with no restrictions.
- The problem is that the address of the `_source` parameter may not necessarily be a real vault contract, and even though the `_source` address is set as a fake malicious contract, the LiquidationPair will be created and added to the `deployedPairs` mapping, and [as stated in the protocol's documentation, **any LiquidationPair created by the factory determines if a pair is legitimate or not**](https://dev.pooltogether.com/protocol/next/guides/liquidating-yield#find-the-liquidation-pair)

![Liquidation Pair Protocol's Documentation](https://res.cloudinary.com/djt3zbrr3/image/upload/v1691397160/PoolTogether/LiquidationPairFactory_Documentation.png)

- So, if a LiquidationPair is created by the LiquidationPairFactory may allow malicious users to trick users who want to liquidate the Vault's Yield to operate with a LiquidationPair who'll end up stealing their POOL tokens (tokenIn) when swapping tokens.

- Practical Example of how the LiquidationPair would steal the user's assets, (Keep in mind that `source` is not the address of a Vault, but an arbitrary contract)
  - The fake `source` contract would look like this:
```solidity
contract FakeSource {

  function targetOf(address _token) external view returns (address) {
    return <ContractCreatorAddress>;
  }

  function liquidate(
    address _account,
    address _tokenIn,
    uint256 _amountIn,
    address _tokenOut,
    uint256 _amountOut
  ) public virtual override returns (bool) {
    return true;
  }

}

```
1. Calling [`LiquidationPair.target()`](https://github.com/GenerationSoftware/pt-v5-cgda-liquidator/blob/7f95bcacd4a566c2becb98d55c1886cadbaa8897/src/LiquidationRouter.sol#L71) will return `source.targetOf(tokenIn)`, and the `source` contract can return any address when the `targetOf()` is called, so, let's say that will return the address of its creator.
  - so, `LiquidationPair.target()` will return the address of its creator, instead of returning the expected address of the `PrizePool` contract

2. Calling [`LiquidationPair::swapExactAmount()`](https://github.com/GenerationSoftware/pt-v5-cgda-liquidator/blob/7f95bcacd4a566c2becb98d55c1886cadb