Vault Factory ownership can be changed immediately and bypass timelock delay
The VaultFactoryV2 contract is supposed to use a timelock contract with a delay period when changing its owner. However, there is a loophole that allows the owner to change the owner address instantly, without waiting for the delay period to expire. This defeats the purpose of the timelock contract and exposes the VaultFactoryV2 contract to potential abuse.\\nIn project description, timelock is required when making critical changes. Admin can only configure new markets and epochs on those markets.\\n```\\n    2) Admin can configure new markets and epochs on those markets, Timelock can make cirital changes like changing the oracle or whitelisitng controllers.\\n```\\n\\nThe VaultFactoryV2 contract has a `changeOwner` function that is supposed to be called only by the timelock contract with a delay period.\\n```\\nfunction changeOwner(address _owner) public onlyTimeLocker {\\n        if (_owner == address(0)) revert AddressZero();\\n        _transferOwnership(_owner);\\n    }\\n```\\n\\nThe VaultFactoryV2 contract inherits from the Openzeppelin Ownable contract, which has a `transferOwnership` function that allows the owner to change the owner address immediately. However, the `transferOwnership` function is not overridden by the `changeOwner` function, which creates a conflict and a vulnerability. The owner can bypass the timelock delay and use the `transferOwnership` function to change the owner address instantly.\\n```\\n    function transferOwnership(address newOwner) public virtual onlyOwner {\\n        require(newOwner != address(0), "Ownable: new owner is the zero address");\\n        _transferOwnership(newOwner);\\n    }\\n```\\n
Override the `transferOwnership` function and add modifier `onlyTimeLocker`.
The transferOwnership is not worked as design (using timelock), the timelock delay become useless. This means that if the owner address is hacked or corrupted, the attacker can take over the contract immediately, leaving no time for the protocol and the users to respond or intervene.
```\\n    2) Admin can configure new markets and epochs on those markets, Timelock can make cirital changes like changing the oracle or whitelisitng controllers.\\n```\\n