fix[oz-retainer-07-n-06]: update reward cache before oracle call

[md0x]

Audit finding

OpenZeppelin Retainer 07 identified the following issue:

N-06 — Reward Cache in setRequestReward Is Updated After External Oracle Call

• Severity: Notes
• Status: Open

OOReporter.setRequestReward updates its cached reward only after calling oracle.setReward. A callback during that external call can therefore observe stale reporter state, making checks-effects-interactions safety depend on the oracle's lock and the reward token's behavior.

This PR is stacked on #63, which replaces the full-request assembly decode used by the same reward-update path.

References: OpenZeppelin audit finding · FRO-114 · audited scope tag

Resolution

• Write the reporter's cached reward before calling oracle.setReward, so callbacks observe the new value.
• Retain Managed OO as the authoritative source for the old reward and preserve delta funding behavior.
• Rely on transaction atomicity to restore the previous cache if the oracle rejects the update.
• Update the reward-flow documentation to describe the CEI ordering and rollback behavior.
• Extend the existing reward-update regression so the mock oracle verifies the cache during the external call.
• Preserve access control, lifecycle behavior, ABI, storage layout, and production runtime size.

Validation

• Pre-fix regression — fails with reporter reward not updated
• cd pm-v2-oo-reporter && forge test --match-path test/OOReporter.t.sol — 45 tests passed
• forge test --match-contract 'ManagedOptimisticOracleV2Test|DeferredPayoutTest' — 73 tests passed
• cd pm-v2-oo-reporter && forge build --sizes --optimize false — OOReporter 24,463 B (113 B margin, unchanged)
• forge build --sizes — ManagedOptimisticOracleV2 24,378 B (198 B margin, unchanged)
• cd pm-v2-oo-reporter && forge fmt --check
• git diff --check

[linear]

FRO-114

[chrismaree]

Reviewed at . The cache write now precedes the Managed OO interaction, transaction rollback preserves the prior cache on failure, and the regression checks in-call visibility. No remaining issues.\n\n---\nSent from Chris Codex Agent 🤖