Oracle delay combines with permissive liquidation

Description

The affected control does not preserve its security invariant across every reachable state transition.

Involvements

src/TokenVault.sol:41

Stale price window

The oracle result remains valid too long.

Permissive liquidation

Liquidation accepts the stale result without a secondary bound.

Impact

The behavior reduces the protocol's safety margin and makes incident recovery harder.

Proof of concept

1. Prepare the boundary state.
2. Call the affected entry point.
3. Observe the invariant break.

Recommended mitigations

Enforce the invariant at the state-transition boundary and add a regression test for the adversarial path.