Token approvals can be stolen in DAOfiV1Router01.addLiquidity()
`DAOfiV1Router01.addLiquidity()` creates the desired pair contract if it does not already exist, then transfers tokens into the pair and calls `DAOfiV1Pair.deposit()`. There is no validation of the address to transfer tokens from, so an attacker could pass in any address with nonzero token approvals to `DAOfiV1Router`. This could be used to add liquidity to a pair contract for which the attacker is the `pairOwner`, allowing the stolen funds to be retrieved using `DAOfiV1Pair.withdraw()`.\\n```\\nfunction addLiquidity(\\n    LiquidityParams calldata lp,\\n    uint deadline\\n) external override ensure(deadline) returns (uint256 amountBase) {\\n    if (IDAOfiV1Factory(factory).getPair(\\n        lp.tokenBase,\\n        lp.tokenQuote,\\n        lp.slopeNumerator,\\n        lp.n,\\n        lp.fee\\n    ) == address(0)) {\\n        IDAOfiV1Factory(factory).createPair(\\n            address(this),\\n            lp.tokenBase,\\n            lp.tokenQuote,\\n            msg.sender,\\n            lp.slopeNumerator,\\n            lp.n,\\n            lp.fee\\n        );\\n    }\\n    address pair = DAOfiV1Library.pairFor(\\n        factory, lp.tokenBase, lp.tokenQuote, lp.slopeNumerator, lp.n, lp.fee\\n    );\\n\\n    TransferHelper.safeTransferFrom(lp.tokenBase, lp.sender, pair, lp.amountBase);\\n    TransferHelper.safeTransferFrom(lp.tokenQuote, lp.sender, pair, lp.amountQuote);\\n    amountBase = IDAOfiV1Pair(pair).deposit(lp.to);\\n}\\n```\\n
Transfer tokens from `msg.sender` instead of `lp.sender`.
```\\nfunction addLiquidity(\\n    LiquidityParams calldata lp,\\n    uint deadline\\n) external override ensure(deadline) returns (uint256 amountBase) {\\n    if (IDAOfiV1Factory(factory).getPair(\\n        lp.tokenBase,\\n        lp.tokenQuote,\\n        lp.slopeNumerator,\\n        lp.n,\\n        lp.fee\\n    ) == address(0)) {\\n        IDAOfiV1Factory(factory).createPair(\\n            address(this),\\n            lp.tokenBase,\\n            lp.tokenQuote,\\n            msg.sender,\\n            lp.slopeNumerator,\\n            lp.n,\\n            lp.fee\\n        );\\n    }\\n    address pair = DAOfiV1Library.pairFor(\\n        factory, lp.tokenBase, lp.tokenQuote, lp.slopeNumerator, lp.n, lp.fee\\n    );\\n\\n    TransferHelper.safeTransferFrom(lp.tokenBase, lp.sender, pair, lp.amountBase);\\n    TransferHelper.safeTransferFrom(lp.tokenQuote, lp.sender, pair, lp.amountQuote);\\n    amountBase = IDAOfiV1Pair(pair).deposit(lp.to);\\n}\\n```\\n