Wemix Retainer 133 PricePolicy

In the contract `PricePolicy`, the role `SETTER` has authority over the following functions: - `setPriceOracle()`: Registers token's price oracle contract. - `setLimitPrice()`: Registers the price to be used as the criterion for determining whether it is a valid price. - `changeRoleManager()`: Change the `RoleManager` contract. Any compromise to the `SETTER` account may allow a hacker to take advantage of this authority and change the price of tokens.

The current implementation of the `isMintableTime()` function checks whether the current time is greater than the timestamp of the TWAP recorded in `priceCache.TimeStamp`: ```solidity=152 function isMintableTime(uint start) public view returns (bool) { return block.timestamp > start; } ``` With the cached price being saved when or before the query occurs, this check will succeed if the price query and TWAP update transactions are not in the same block. The function does not account for the possibility that the cached TWAP price might be stale. A stale TWAP price, which has not been updated for an extended period, could lead to outdated pricing data being used within the protocol.