Because the `transferCurvesToken` function doesn't check if `amount` is greater than 0, a malicious user can permanently block other users from buying new curves tokens and depositing.
Audit: 2024-01-curves-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2024-01-curves/blob/516aedb7b9a8d341d0d2666c23780d2bd8a9a600/contracts/Curves.sol#L296-L299


# Vulnerability details

## Impact
A malicious user can increase another user's number of owned curves token massively by using `transferCurvesToken` function and this may occur DoS when the victim tries to buy new curves token or call `deposit` function.

## Proof of Concept
Users can transfer their tokens to the others by using `transferCurvesToken` function.
But, as you can see, this function doesn't check if `amount` is greater than 0.
```solidity
    function transferCurvesToken(address curvesTokenSubject, address to, uint256 amount) external {
        if (to == address(this)) revert ContractCannotReceiveTransfer();
        _transfer(curvesTokenSubject, msg.sender, to, amount);
    }

    // ...

    function _transfer(address curvesTokenSubject, address from, address to, uint256 amount) internal {
        if (amount > curvesTokenBalance[curvesTokenSubject][from]) revert InsufficientBalance();

        // If transferring from oneself, skip adding to the list
        if (from != to) {
            _addOwnedCurvesTokenSubject(to, curvesTokenSubject);
        }

        curvesTokenBalance[curvesTokenSubject][from] = curvesTokenBalance[curvesTokenSubject][from] - amount;
        curvesTokenBalance[curvesTokenSubject][to] = curvesTokenBalance[curvesTokenSubject][to] + amount;

        emit Transfer(curvesTokenSubject, from, to, amount);
    }

    // Internal function to add a curvesTokenSubject to the list if not already present
    function _addOwnedCurvesTokenSubject(address owner_, address curvesTokenSubject) internal {
        address[] storage subjects = ownedCurvesTokenSubjects[owner_];
        for (uint256 i = 0; i < subjects.length; i++) {
            if (subjects[i] == curvesTokenSubject) {
                return;
            }
        }
        subjects.push(curvesTokenSubject);
    }
```
Therefore, a malicious user can increase another user's `ownedCurvesTokenSubjects` value by calling this `transferCurvesToken` function with params of `curvesTokenSubject` as an arbitrary address, `to` as the victim's address and `amount` as 0.
If the malicious user repeats above action massively with different `curvesTokenSubject` param each time, it is possible that reach to the block gas limit due to following for loop and may occur DoS.
```solidity
    function _addOwnedCurvesTokenSubject(address owner_, address curvesTokenSubject) internal {
        address[] storage subjects = ownedCurvesTokenSubjects[owner_];
@>        for (uint256 i = 0; i < subjects.length; i++) {
            if (subjects[i] == curvesTokenSubject) {
                return;
            }
        }
        subjects.push(curvesTokenSubject);
    }
```
Since `_buyCurvesToken` and `_transfer` use this `_addOwnedCurvesTokenSubject` function, the victim cannot buy new curves token and deposit.
```solidity
    function _buyCurvesToken(address cur