Anyone can win all the funds from the LiquidityMining without investing any DAI
When a user decides to `investDAI` in the `LiquidityMining` contract, the policy book address is passed as a parameter:\\n```\\nfunction investDAI(uint256 \\_tokensAmount, address \\_policyBookAddr) external override {\\n```\\n\\nBut this parameter is never checked and only used at the end of the function:\\n```\\nIPolicyBook(\\_policyBookAddr).addLiquidityFromLM(msg.sender, \\_tokensAmount);\\n```\\n\\nThe attacker can pass the address of a simple multisig that will process this transaction successfully without doing anything. And pretend to invest a lot of DAI without actually doing that to win all the rewards in the `LiquidityMining` contract.
Check that the pool address is valid.
```\\nfunction investDAI(uint256 \\_tokensAmount, address \\_policyBookAddr) external override {\\n```\\n