Wrong update of feeManager, poolManager, or voteDelegate (Booster.sol) can lock its functionality

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/convex-platform/contracts/contracts/Booster.sol#L139
https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/convex-platform/contracts/contracts/Booster.sol#L149
https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/convex-platform/contracts/contracts/Booster.sol#L192

Vulnerability details

By mistake, if wrong addresses of the above are set then the contracts functionality will be impacted. Or if address is set to a contract (poolManagerProxy for poolManager) which does not have means to set it again.

Impact

Currently, feeManager can only be set by a feeManager role using setFeeManager function. In case of any unwanted activity, say given wrong address or a null address, the operations accessible to feeManager could not be accessed anymore. Moreover, the feeManager can not be set anymore, since only feeManager can update it.
Same applies for poolManger(setPoolManager) and voteDelegate(setVoteDelegate).
The impact is, operations accessible for feeManager, poolManager or voteDelegate can not be accessed anymore.

Proof of Concept

function setFeeManager
https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/convex-platform/contracts/contracts/Booster.sol#L139
function setPoolManager
https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/convex-platform/contracts/contracts/Booster.sol#L149
function setVoteDelegate
https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/convex-platform/contracts/contracts/Booster.sol#L192
deploySystem.ts
https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/scripts/deploySystem.ts#L613

Tools Used

Manual review

Recommended Mitigation Steps

Additionally, add owner accessibility to each function on the given require statement.
For function setFeeManager,

require(msg.sender == feeManager || msg.sender==owner, "!auth");

For function setPoolManager,

require(msg.sender==poolManager || msg.sender==owner, "!auth");

For function setVoteDelegate,

require(msg.sender==voteDelegate || msg.sender==owner, "!auth");

[dmvt]

Per #364 (comment) I have decided to downgrade this to QA.