fix[oz-retainer-07-n-02]: uppercase oracle constants

[md0x]

Audit finding

OpenZeppelin Retainer 07 identified the following issue:

N-02 — Constants Not Using UPPER_CASE Format

• Severity: Notes
• Status: Open

OOReporterStorageLocation in OOReporter.sol and ancillaryBytesLimit in OptimisticOracleV2Interface.sol do not follow Solidity's uppercase-with-underscores convention for constants.

References: OpenZeppelin audit findings · FRO-101 · audited scope tag

Resolution

• Rename OOReporterStorageLocation to OO_REPORTER_STORAGE_LOCATION and update its assembly reference.
• Add ANCILLARY_BYTES_LIMIT and update the OO_ANCILLARY_DATA_LIMIT derivation to use it.
• Preserve the legacy ancillaryBytesLimit() selector through a deprecated compatibility getter.
• Preserve both constant values and the ERC-7201 storage slot unchanged.
• The private storage constant rename has no behavior, ABI, or storage-layout impact; the public uppercase getter is additive and the legacy getter remains callable.

Validation

• forge fmt --check — passed in CI with Foundry 1.3.6
• forge build --sizes
• forge test -vvv --no-match-contract ".*Fork.*" — 77 tests passed
• cd pm-v2-oo-reporter && forge fmt --check
• cd pm-v2-oo-reporter && forge test --match-path test/OOReporter.t.sol — 39 tests passed
• git diff --check

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[linear]

FRO-101

[Reinis-FRP]

This is public, I'm not sure we can be 100% confident that none of existing integrations relied on this and could break their ABI compatability

[chrismaree]

Agreed. Solidity emits an external getter for a public constant, and the tracked ManagedOptimisticOracleV2 ABI includes ancillaryBytesLimit() (0xc371dda7). The rename replaces it with ANCILLARY_BYTES_LIMIT() (0x7bda7981), so absence of internal usages does not prove downstream safety.

I pushed e608e3c, which keeps the uppercase constant for the audit finding and adds a deprecated ancillaryBytesLimit() compatibility getter returning it. I left this thread unresolved per our review policy.

---

Sent from Chris Codex Agent 🤖

[chrismaree]

Reviewed the exact post-fix head. The uppercase constants satisfy FRO-101, the private storage slot value is unchanged, and the deprecated ancillaryBytesLimit() compatibility getter preserves the published selector while the new uppercase getter is additive. git diff --check is clean; I did not run builds or tests.

---

Sent from Chris Codex Agent 🤖