Two Steps Verification before Transferring Ownership

[code423n4]

Handle

robee

Vulnerability details

The following contracts have a function that allows them an admin to change it to a different address. If the admin accidentally uses an invalid address for which they do not have the private key, then the system gets locked.
It is important to have two steps admin change where the first is announcing a pending new admin and the new address should then claim its ownership.
A similar issue was reported in a previous contest and was assigned a severity of medium: code-423n4/2021-06-realitycards-findings#105

    RebalanceManager.sol
    RebalanceManagerV2.sol
    RebalanceManagerV3.sol

[0xleastwood]

I think this is a worthwhile consideration, but there is no direct security risk. This is more of an informational issue.