Two-step change of a critical parameter

[code423n4]

Handle

certora

Vulnerability details

https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/callManagers/RebalanceManagerV2.sol#L43

In RebalanceManagerV2 function setRebalanceManager allows an admin to change it to a different address. This function has no validations, even a simple check for zero-address is missing, and there is no validation of the new address being correct. If the admin accidentally uses an invalid address for which they do not have the private key, then the system gets locked because the swivel cannot be corrected and none of the other functions that require admin caller can be executed. A similar issue was reported in a previous contest and was assigned a severity of medium: code-423n4/2021-06-realitycards-findings#105

Recomendation

add two steps for admin change.

[loki-sama]

Cant check every value that could be set wrong.

[0xleastwood]

Don't think this poses any security concern and it adds unnecessary overhead for all state changing functions. Marking as non-critical.