Summary

Dangerous usage of block.timestamp. block.timestamp can be manipulated by miners.

Vulnerability Details

This calculation can be manipulated by a miner: uint256 secondsSince = block.timestamp - updatedAt;

Impact

If a miner wants to prevent the contract from reverting, they could manipulate the block.timestamp value so that the difference between it and the updatedAt variable is always less than or equal to the TIMEOUT value.

Tools Used

Slither and manual code review.

Recommendations

Use an external oracle service to provide a reliable source of time data and avoid using block.timestamp, which can be exploited.