[audit-10] document: [TRST-L-7] update()

[matiasedgeandnode]

This patch is NOT A FIX but rather adding some docs. Here's the rationale:

1. Limited Impact: Opportunity for gain is limited to the last collection period.

2. Mutual Agreement Required: The update() function requires a signed RCAU (Recurring Collection Agreement Update) from the payer. This means any pricing changes are explicitly
   agreed upon by both parties, not a unilateral action by the service provider. Both parties are aware of and consent to the new terms.

3. Implementation Complexity: The suggested mitigation of updating lastCollectionAt to the current timestamp would create periods where no fees can be collected if indexers forget to collect in the same tx before updating. Forcing this collection would also complicate the code.

4. Existing Safeguards: The protocol already has multiple safeguards:

   • Minimum and maximum collection windows (minSecondsPerCollection, maxSecondsPerCollection)
   • The requirement for authorized signatures on updates
   • Natural bounds on the affected time period

This PR adds a small bit of documentation to make this behavior explicit in the contract comments, ensuring all integrators understand the timing implications when implementing update strategies.

[openzeppelin-code]

[audit-10] document: [TRST-L-7] update()

Generated at commit: 308d6e6d07e6dfcf499494f47d06f8f9580bf1a7

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	2 4 0 15 39 60
Dependencies	Critical High Medium Low Note Total	0 0 0 0 0 0

---

For more details view the full report in OpenZeppelin Code Inspector