Submitted by cccz
RewardThrottle.setTimekeeper allows POOLUPDATERROLE to update the timekeeper when RewardThrottle is active:
if newTimekeeper.epoch changes, it will cause the following:
https://github.com/code-423n4/2023-02-malt/blob/700f9b468f9cf8c9c5cffaa1eba1b8dea40503f9/contracts/RewardSystem/RewardThrottle.sol#L690-L696
Consider only allowing setTimekeeper to be called when RewardThrottle is not active.
0xScotch (Malt) confirmed and commented:
