PP

[chrismaree]

What Changed

• Adds SignedProposer, a permissioned Permit2 witness-signature relay for submitting Managed Optimistic Oracle V2 proposals on behalf of off-chain signers.
• Adds explicit role management for delegated relayers and whitelist administrators, including helper methods for adding/removing role members and transferring whitelists owned by SignedProposer to a replacement deployment.
• Resolves each request's effective proposer whitelist at execution time, preferring a custom whitelist over the oracle default. Proposers are added temporarily only when needed, and pre-existing whitelist entries are preserved.
• Supports signer-authorized order-flow payments: maxPayment is included in the signed proposal witness, the relayer chooses an actual payment up to that cap, and retained payments can be withdrawn by the admin.
• Hardens token accounting by validating the permit token against the oracle request currency, verifying the exact Permit2 amount received, measuring the oracle's actual token pull instead of trusting its return value, refunding excess funds, and limiting/revoking oracle allowance around proposePriceFor.
• Blocks reentrant proposal callbacks and documents the trust assumption that signers and relayers must validate the oracle address before signing or submitting a proposal.
• Adds tryMulticall(bytes[]) for delegated relayers to execute independent proposal attempts without ordinary child reverts rolling back successful siblings. Existing OpenZeppelin atomic multicall(bytes[]) remains unchanged.
• Vendors Permit2, pins Foundry 1.3.6, adds deployment configuration and DeploySignedProposer.s.sol, and documents deployment, role, whitelist, payment, batching, and Polygon capacity behavior.
• Adds extensive unit, adversarial-oracle, real-Permit2, maximum-calldata, and pinned Polygon fork coverage.

Why

• Proposers need to authorize specific oracle proposals and their token spend off-chain while allowing a delegated relayer to submit them and optionally collect a signer-capped execution payment.
• Permit2 witness signatures bind the oracle proposal fields, token amount, nonce, deadline, spender, and maximum payment into one authorization path.
• Runtime whitelist resolution and temporary membership allow the relay to work with Managed OO request-specific whitelist configuration without removing existing proposer access.
• Partial-success batching avoids retrying already successful independent proposals when another proposal in the same transaction reverts.

Impact

• This introduces a new opt-in proposal relay; existing direct Managed OO proposal flows and atomic multicall behavior are unchanged.
• Only accounts with DELEGATED_PROPOSER_ROLE may execute signed proposals or partial-success batches. Administrative and whitelist operations remain separately permissioned.
• The Permit2 nonce, token transfer, temporary whitelist changes, oracle allowance, token pull, refund, and payment accounting are atomic within each proposal attempt. A reverting child rolls all of that child's state back.
• tryMulticall has no production batch-size or per-child gas magic numbers. Under EIP-150, an out-of-gas child may return false while preserving enough outer gas to continue, may starve later children, or may ultimately cause the outer batch to revert. A false result is therefore an unsuccessful execution attempt, not proof that the proposal itself is invalid.
• On Polygon, transaction size is the binding worst-case batch constraint before gas: with 8,139 bytes of maximum non-zero OOv2 ancillary data, 14 proposals produce 124,612 bytes of outer calldata and fit; 15 produce 133,508 bytes and exceed Bor's 131,072-byte transaction limit before EVM execution.
• Signers and delegated relayers must validate proposal.oracle. The chosen oracle supplies the request currency and receives an allowance for the signed proposal execution, so an unintended oracle can spend up to the Permit2-authorized amount for that proposal.

High risk Sections to review with detail

• Permit2 witness construction: verify that the proposal type hash binds oracle, requester, identifier, timestamp, ancillary data hash, proposed price, and maxPayment, while Permit2 binds token, amount, nonce, deadline, signer, and SignedProposer as spender.
• Token and bond accounting: review currency matching, exact-receipt validation, balance-delta bond calculation, payment bounds, excess refunds, retained payments, and withdrawal authorization.
• Oracle allowance window: verify allowance is granted only immediately before proposePriceFor, revoked immediately afterward, and is not exposed during whitelist add/remove hooks.
• Whitelist resolution and ownership: review custom-over-default resolution, temporary membership behavior, preservation of existing entries, whitelist-admin permissions, and ownership handoff safeguards.
• Reentrancy and malicious-oracle boundary: review callback protection and the documented requirement for off-chain oracle validation.
• Partial-success batching: verify selector prevalidation, delegated-relayer access control, caller preservation through self-delegatecall, per-child rollback, nested-batch blocking, failure metadata, and EIP-150 gas-starvation behavior.
• Polygon capacity: review the maximally packed 14/15 boundary, Bor's 128 KiB transaction limit, and the pinned 53,902,641 Polygon block gas limit used by the test.
• Deployment/configuration: verify canonical Permit2 addresses, admin assignment, required whitelist ownership, delegated-relayer setup, Foundry pinning, and environment documentation for each target chain.

Validation

• Foundry 1.3.6: forge fmt --check
• Foundry 1.3.6: forge build --sizes
• Full non-fork suite: 132 tests passed
• Pinned Polygon fork suite: 16 tests passed
• Real Permit2 coverage includes valid signatures, spender/witness/payment tampering, multiple signers and nonces, and failed-child nonce/token rollback.
• Adversarial coverage includes malicious oracle return values and drains, allowance exposure during whitelist hooks, short token transfers, currency mismatch, reentrant callbacks, gas exhaustion before and after token movement, sibling ordering, empty failure metadata ambiguity, large revert-data hashing, and full outer-revert rollback.
• Maximum Polygon calldata coverage verifies 8,139 non-zero ancillary bytes, 8,804 bytes per encoded child, a successful 14-proposal batch, and rejection-size calldata at 15 proposals.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T13:02:15.126718Z	733aec2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.