CVE-2022-48216: Uniswap Universal Router Incorrect Authorization vulnerability

The vulnerability stemmed from the execute() function in UniversalRouter.sol not having reentrancy protection. The commit d82c668 shows the function was modified to include an isNotLocked modifier from a new ReentrancyLock contract. This indicates the original execute() function was vulnerable to reentrancy attacks where malicious contracts (e.g., via NFT callbacks or token transfers) could re-enter the execute function during transaction processing to steal funds left in the contract between commands. The added test ReenteringProtocol.sol demonstrates this attack vector, and gas test changes show the security mechanism's overhead.