MEDIUM severity: The vulnerability arises from the protocol's design, which allows users to manipulate the `updatedAt. The vulnerability arises from the protocol's design, which allows users to manipulate the `updatedAt` timestamp of a short record by appending new orders to the last short record. This enables users to circumvent liquidation by adjusting the time difference, thereby avoiding liquidation even when th...

Vulnerable code:
```\nfunction flagShort(address asset, address shorter, uint8 id, uint16 flaggerHint)\n    external\n    isNotFrozen(asset)\n    nonReentrant\n    onlyValidShortRecord(asset, shorter, id)\n{\n    short.setFlagger(cusd, flaggerHint);\n    emit Events.FlagShort(asset, shorter, id, msg.sender, adjustedTimestamp);\n}\n```\n```\nfunction _canLiquidate(\n    MTypes.MarginCallPrimary memory m\n) \n    private\n    view\n    returns (bool)\n{\n    uint256 timeDiff = LibOrders.getOffsetTimeHours() - m.short.updatedAt;\n    uint256 resetLiquidationTime = LibAsset.resetLiquidationTime(m.asset);\n\n    if (timeDiff >= resetLiquidationTime) {\n        return false;\n    } else {\n        uint256 secondLiquidationTime = LibAsset.secondLiquidationTime(m.asset);\n        bool isBetweenFirstAndSecondLiquidationTime = \n            timeDiff > LibAsset.firstLiquidationTime(m.asset) \n            && timeDiff <= secondLiquidationTime \n            && s.flagMapping[m.short.flaggerId] == msg.sender;\n        bool isBetweenSecondAndResetLiquidationTime = \n            timeDiff > secondLiquidationTime \n            && timeDiff <= resetLiquidationTime;\n        if (\n           !(\n                (isBetweenFirstAndSecondLiquidationTime) \n                || (isBetweenSecondAndResetLiquidationTime)\n            )\n        ) {\n            revert Errors.MarginCallIneligibleWindow();\n        }\n\n        return true;\n    }\n}\n```\n```\nfunction fillShortRecord(\n    address asset,\n    address shorter,\n    uint8 shortId,\n    SR status,\n    uint88 collateral,\n    uint88 ercAmount,\n    uint256 ercDebtRate,\n    uint256 zethYieldRate\n) internal {\n    AppStorage storage s = appStorage();\n\n    uint256 ercDebtSocialized = ercAmount.mul(ercDebtRate);\n    uint256 yield = collateral.mul(zethYieldRate);\n\n    STypes.ShortRecord storage short = s.shortRecords[asset][shorter][shortId];\n    if (short.status == SR.Cancelled) {\n        short.ercDebt = short.collateral = 0;\n    }\n\n    short.status = status;\n    LibShortRecord.merge(\n        short,\n        ercAmount,\n        ercDebtSocialized,\n        collateral,\n        yield,\n        LibOrders.getOffsetTimeHours()\n    );\n}\n```\n```\nfunction merge(\n    STypes.ShortRecord storage short,\n    uint88 ercDebt,\n    uint256 ercDebtSocialized,\n    uint88 collateral,\n    uint256 yield,\n    uint24 creationTime\n) internal {\n    ercDebtSocialized += short.ercDebt.mul(short.ercDebtRate);\n    short.ercDebt += ercDebt;\n    short.ercDebtRate = ercDebtSocialized.divU64(short.ercDebt);\n\n    yield += short.collateral.mul(short.zethYieldRate);\n    short.collateral += collateral;\n    short.zethYieldRate = yield.divU80(short.collateral);\n\n    short.updatedAt = creationTime;\n}\n```