Whitelist registration bypassed via flash loan

[angguntrie3-lgtm]

hey, found that the whitelist registration in WhitelistRegistry.sol can be bypassed with a flash loan.

The balance check only validates at call time — tokens are never staked or locked:

// WhitelistRegistry.sol:75-82
function register() external {
    uint256 percentageThreshold = resolverPercentageThreshold;
    uint256 totalSupply = TOKEN.totalSupply();
    if (!_isValidBalance(percentageThreshold, TOKEN.balanceOf(msg.sender), totalSupply)) revert BalanceLessThanThreshold();
    if (!_whitelist.add(msg.sender)) revert AlreadyRegistered();
    emit Registered(msg.sender);
    _clean(percentageThreshold, totalSupply);
}

Exploit (atomic):

1. Flash-loan >= threshold% of 1INCH supply (1INCH is listed on Aave)
2. register() passes balance check while holding loaned tokens
3. Settle orders with whitelisted privileges (lower fees / Fusion priority)
4. Repay flash loan

The "skin in the game" threshold is meaningless against flash loans. Is this a known limitation?