Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
Description
Bug Description
The similar issue has found by the previous OpenZeppelin audit but they don't specify all the affected actions, and anvil team only fix the `depositAndStake` function, the other affected actions aren't reported and fixed in the previous audits, so this issue shouldn't be considered as known issue from my perspective.
The `modifyCollateralizableTokenAllowanceWithSignature` function in CollateralVault is vulnerable to signature front-running attacks. When the `TimeBasedCollateralPool` contract `stake` and `stakeReleasableTokensFrom` functions call the `modifyCollateralizableTokenAllowanceWithSignature` function to modify the allowance by signature, an attacker can monitor the mempool and front-run the transaction by calling the `modifyCollateralizableTokenAllowanceWithSignature` function first, then the original transaction will fail because the nonce is already used.
The vulnerability exists because:
The signature verification uses a nonce system that increments upon each use.
The `modifyCollateralizableTokenAllowanceWithSignature` function can be called by anyone to cause the signature nonce to be incremented.
Once a signature is used and the nonce is incremented, the original transaction will fail
Impact
Any users `stake` or `stakeReleasableTokensFrom` txs can be front-run by attackers to revert.
Recommendation
Fix as the `depositAndStake` function.
Proof of Concept
Proof of Concept
```solidity // SPDX-License-Identifier: MIT pragma solidity ^0.8.19;