Illuvium Yield Farming Rewards

Several comments suggest that `blocksPerUpdate` should equal 2 weeks, but is defined in blocks which have variable mining times. It is not clear why `timestamp` is not used for this variable instead, particularly since block timestamp manipulation will have minimal effect for such a large timespan.

The `IlluviumPoolBase._unstake` function (inherited by `IlluviumFlashPool`) does not check if `block.timestamp > lockedUntil` of a deposit. The `IlluviumCorePool` adds a check in its overridden function `_unstake`, however, `IlluviumFlashPool` does not override the `_unstake` function.

The clone-and-own approach involves copying and adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of effort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain a security vulnerability, or may include intentionally or unintentionally modified upstream libraries. <br><br> All files in the `utils/` sub-directory are cloned from open source repositories such as openzeppelin.

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. The following instances of this issue have been identified: 1. The `owner` of the `TokenLocking` contract can perform the following privileged actions: * Set the `pool` address for ILV staking (only once). * Set the balances of tokens owned by any address, e.g. pre-seed investors, seed investors, team members, etc. This can be done multiple times. 2. The `owner` of `IlluviumPoolFactory` can create/register unlimited pools at will.