L-07 [Oval] Missing Input Validation

[Reinis-FRP]

Addresses audit issue: L-07 [Oval] Missing Input Validation

The deployer of the CoinbaseOracle contract sets the immutable reporter variable
during the contract's construction. The reporter is the sole entity authorized to submit new
prices to the oracle via the pushPrice function. The access control mechanism in
pushPrice involves recovering the signer of the provided message and verifying that it
matches the reporter's address. However, the ecrecover precompile does not fail on invalid
signatures. Instead, it returns the zero address. If the reporter address is erroneously
configured to the zero address, it becomes trivial for any entity to push arbitrary prices to the
oracle contract.

Consider implementing a validation check to ensure that the reporter address is not set to the
zero address to prevent erroneous contract deployments.

This implements the recommended fix by validating CoinbaseOracle constructor parameters.

[linear]

UMA-2652 L-07 [Oval] Missing Input Validation

[md0x]

There is another open PR to fix M-02 that hardcodes the reporter address in the CoinbaseOracle:

oval-contracts/src/oracles/CoinbaseOracle.sol

Line 31 in c2580bf

function reporter() public view virtual returns (address) {

.

If we agree on these changes to fix M-02, L-07 will also be fixed, so probably these changes won’t be required anymore.

[chrismaree]

agreed. ideally this is all hard coded as it should never change.