newLien.lender can steal NFT that should belong to oldLien.lender after refinancing

Lines of code Vulnerability details Impact After calling the following ParticleExchange.refinanceLoan function, collection are the same and tokenId become newLien.tokenId for both the old and new liens. function refinanceLoan Lien calldata oldLien, uint256 oldLienId, Lien calldata newLien, uint25...