`onTokenTransfer` does not validate if the call is from the DATA token contract
`SponsorshipFactory::onTokenTransfer` and `OperatorFactory::onTokenTransfer` are used to handle the token transfer and contract deployment in a single transaction. But there is no validation that the call is from the DATA token contract and anyone can call these functions.\\nThe impact is low for `Sponsorship` deployment, but for `Operator` deployment, `ClonesUpgradeable.cloneDeterministic` is used with a salt based on the operator token name and the operator address. An attacker can abuse this to cause DoS for deployment.\\nWe see that this validation is implemented correctly in other contracts like `Operator`.\\n```\\n       if (msg.sender != address(token)) {\\n           revert AccessDeniedDATATokenOnly();\\n       }\\n```\\n
Add a validation to ensure the caller is the actual DATA contract.
Attackers can prevent the deployment of `Operator` contracts.
```\\n       if (msg.sender != address(token)) {\\n           revert AccessDeniedDATATokenOnly();\\n       }\\n```\\n