Description
SyrupRouter::_deposit() checks for owner permission to deposit, but due to transferring the shares later in ERC20Helper::transfer(), it also requires P:transfer permission.
Recommendation
According to the specifications, P:transfer and P:transferFrom should be permissionless, so this is not a problem. However, consider adding a comment in the code.
Status
Acknowledged