No way to revoke approval in the SDLPool might lead to unauthorized calling transfer of locks.
There is no way to revoke the approval which given via the approvefunction They may able execute transfers even after the owner revokes their permission using the `setApprovalForAll` function.\\nThe `setApprovalForAll` function allows the owner to approve anyone as the operator.\\n```\\n    function setApprovalForAll(address _operator, bool _approved) external {\\n        address owner = msg.sender;\\n        if (owner == _operator) revert ApprovalToCaller();\\n\\n        operatorApprovals[owner][_operator] = _approved;\\n        emit ApprovalForAll(owner, _operator, _approved);\\n    }\\n```\\n\\nIn the same vein, the `approve` function allows the owner or operator to `approve` anyone to transfer the lock.\\n```\\n    function approve(address _to, uint256 _lockId) external {\\n        address owner = ownerOf(_lockId);\\n\\n        if (_to == owner) revert ApprovalToCurrentOwner(); //@note\\n        if (msg.sender != owner && !isApprovedForAll(owner, msg.sender)) revert SenderNotAuthorized();\\n\\n        tokenApprovals[_lockId] = _to;\\n        emit Approval(owner, _to, _lockId);\\n    }\\n```\\n\\nNote that in the function, lock cannot be approved to the owner (but can be approved to any of the operators), and can be called by the owner/operator (see the `isApprovedForAll` modifier).\\nIf the operator approves himself to the lock, using the `approve` function, and later on, his operator status gets revoked, his lock approval status is not cleared, meaning he still has access to the lock.\\nAs an extreme example\\nUser1 owns 5 locks.\\nHe calls the `setApprovalForAll` setting User2 as his operator.\\nUser2 calls the `approve` function on all 5 locks (It succeeds as there's no check preventing this unlike with the lock owner), getting herself both operator approval and token approvals.\\nUser1 revokes User2's operator status.\\nUser2 still has access to the locks and can transfer them.
No way to revoke approval in the SDLPool might lead to unauthorized calling transfer of locks.\\nInclude a check to see if the `_to` in the `approve` function is an operator, revert if it is. Or clear an operator's token approvals after revoking his operator status.
Uncleared approval, gives access to transfer token.
```\\n    function setApprovalForAll(address _operator, bool _approved) external {\\n        address owner = msg.sender;\\n        if (owner == _operator) revert ApprovalToCaller();\\n\\n        operatorApprovals[owner][_operator] = _approved;\\n        emit ApprovalForAll(owner, _operator, _approved);\\n    }\\n```\\n