If a user approves junior vault tokens to WithdrawPeriphery, anyone can withdraw/redeem his/her token
If users want to withdraw/redeem tokens by WithdrawPeriphery, they should approve token approval to WithdrawPeriphery, then call `withdrawToken()` or `redeemToken()`. But if users approve `dnGmxJuniorVault` to WithdrawPeriphery, anyone can withdraw/redeem his/her token.\\nUsers should approve `dnGmxJuniorVault` before calling `withdrawToken()` or redeemToken():\\n```\\n    function withdrawToken(\\n        address from,\\n        address token,\\n        address receiver,\\n        uint256 sGlpAmount\\n    ) external returns (uint256 amountOut) {\\n        // user has approved periphery to use junior vault shares\\n        dnGmxJuniorVault.withdraw(sGlpAmount, address(this), from);\\n// rest of code\\n\\n    function redeemToken(\\n        address from,\\n        address token,\\n        address receiver,\\n        uint256 sharesAmount\\n    ) external returns (uint256 amountOut) {\\n        // user has approved periphery to use junior vault shares\\n        dnGmxJuniorVault.redeem(sharesAmount, address(this), from);\\n// rest of code\\n```\\n\\nFor better user experience, we always use `approve(WithdrawPeriphery, type(uint256).max)`. It means that if Alice approves the max amount, anyone can withdraw/redeem her tokens anytime. Another scenario is that if Alice approves 30 amounts, she wants to call `withdrawToken` to withdraw 30 tokens. But in this case Alice should send two transactions separately, then an attacker can frontrun `withdrawToken` transaction and withdraw Alice's token.
Replace `from` parameter by `msg.sender`.\\n```\\n        // user has approved periphery to use junior vault shares\\n        dnGmxJuniorVault.withdraw(sGlpAmount, address(this), msg.sender);\\n\\n        // user has approved periphery to use junior vault shares\\n        dnGmxJuniorVault.redeem(sharesAmount, address(this), msg.sender);\\n```\\n
Attackers can frontrun withdraw/redeem transactions and steal tokens. And some UI always approves max amount, which means that anyone can withdraw users tokens.
```\\n    function withdrawToken(\\n        address from,\\n        address token,\\n        address receiver,\\n        uint256 sGlpAmount\\n    ) external returns (uint256 amountOut) {\\n        // user has approved periphery to use junior vault shares\\n        dnGmxJuniorVault.withdraw(sGlpAmount, address(this), from);\\n// rest of code\\n\\n    function redeemToken(\\n        address from,\\n        address token,\\n        address receiver,\\n        uint256 sharesAmount\\n    ) external returns (uint256 amountOut) {\\n        // user has approved periphery to use junior vault shares\\n        dnGmxJuniorVault.redeem(sharesAmount, address(this), from);\\n// rest of code\\n```\\n