BalancerLBPSwapper - init() can be front-run to potentially steal tokens
The deployment process for `BalancerLBPSwapper` appears to be the following:\\ndeploy `BalancerLBPSwapper`.\\nrun `ILiquidityBootstrappingPoolFactory.create()` proving the newly deployed swapper address as the owner of the pool.\\ninitialize `BalancerLBPSwapper.init()` with the address of the newly created pool.\\nThis process may be split across multiple transactions as in the `v2Phase1.js` deployment scenario.\\nBetween step (1) and (3) there is a window of opportunity for someone to maliciously initialize contract. This should be easily detectable because calling `init()` twice should revert the second transaction. If this is not caught in the deployment script this may have more severe security implications. Otherwise, this window can be used to grief the deployment initializing it before the original initializer does forcing them to redeploy the contract or to steal any tokenSpent/tokenReceived that are owned by the contract at this time.\\nNote: It is assumed that the contract will not own a lot of tokens right after deployment rendering the scenario of stealing tokens more unlikely. However, that highly depends on the deployment script for the contract system.\\n```\\nfunction init(IWeightedPool \\_pool) external {\\n    require(address(pool) == address(0), "BalancerLBPSwapper: initialized");\\n\\n    pool = \\_pool;\\n    IVault \\_vault = \\_pool.getVault();\\n\\n    vault = \\_vault;\\n\\n    // Check ownership\\n    require(\\_pool.getOwner() == address(this), "BalancerLBPSwapper: contract not pool owner");\\n```\\n\\n```\\nIERC20(tokenSpent).approve(address(\\_vault), type(uint256).max);\\nIERC20(tokenReceived).approve(address(\\_vault), type(uint256).max);\\n```\\n
protect `BalancerLBPSwapper.init()` and only allow a trusted entity (e.g. the initial deployer) to call this method.
```\\nfunction init(IWeightedPool \\_pool) external {\\n    require(address(pool) == address(0), "BalancerLBPSwapper: initialized");\\n\\n    pool = \\_pool;\\n    IVault \\_vault = \\_pool.getVault();\\n\\n    vault = \\_vault;\\n\\n    // Check ownership\\n    require(\\_pool.getOwner() == address(this), "BalancerLBPSwapper: contract not pool owner");\\n```\\n