docs[oz-retainer-07-n-01]: document unbounded oracle allowance

[md0x]

Audit finding

OpenZeppelin Retainer 07 identified the following issue:

N-01 — Avoid Unbounded Allowance To The Oracle To Limit Exposure

• Severity: Notes
• Status: Open

When allowance is below a request's reward, _requestPrice grants the oracle type(uint256).max approval instead of approving only the required reward. The trusted oracle retains standing authority over the reporter's entire reward-token balance; if compromised through a leaked key or malicious implementation, it could drain the full balance rather than only the amount committed to one request. Approve only the reward for each request so the allowance is consumed by requestPrice. If unlimited approval is retained for gas savings, document the decision and oracle trust assumptions.

References: OpenZeppelin audit findings · FRO-102 · audited scope tag

Resolution

• Retain the unbounded approval for gas savings and take the finding's documentation path: document the decision and the oracle trust assumptions instead of switching to per-request approvals.
• Document at the _requestPrice approval site that the unbounded allowance is intentional, that the Managed OO is fixed at initialization within the reporter's UMA-governed trust domain, and that exposure is capped by the reporter's reward balance.
• Add an "Oracle Reward Allowance" README section covering the decision, the trust assumptions, and the operational guidance to fund the reporter with a working reward float rather than a treasury balance.
• Document in initializeRequest/rerequest NatSpec that rewards are paid from the reporter's balance and that the reporter tops the trusted oracle's allowance up to an unbounded approval instead of approving per request.
• Documentation-only change: no behavior, selector, event/error signature, or storage changes.

Validation

• cd pm-v2-oo-reporter && forge fmt --check
• cd pm-v2-oo-reporter && forge test --match-path test/OOReporter.t.sol — 39 tests passed
• git diff --check

🤖 Generated with Claude Code

[chrismaree]

Reviewed against FRO-102. The finding explicitly permits retaining the unbounded approval when the trust decision is documented, and this PR accurately records the Managed OO trust boundary, actual exposure, and working-float guidance without changing behavior or ABI.

---

Sent from Chris Codex Agent 🤖