_reimburse and createProxyDelegatorAndTransfer uses ERC20Votes.transferFrom with user as msg.sender, but allowance is given for ERC20MultiDelegate contract.

Lines of code Vulnerability details Description The delegateMulti external method is called by user. This function call some internal functions like reimburse and transferBetweenDelegators, which doesn't change the msg.sender because they are internal. So, when these functions try to use...