Boundary (assumed vs actual at the oracle boundary). q.askedAt is the sequencer's block timestamp at the time of ask; a.issuedAt is the attester's wall-clock stamp. The canonical verifier (OracleAttestationConsumer._verifyAttestation, src/OracleAttestation.sol:161) explicitly budgets 5 minutes (ISSUED_AT_TOLERANCE) for the attester clock sitting AHEAD of the chain clock, because 'the attester stamps with its own wall clock; a block's timestamp is a validator's'.

AskOracle adds the opposite bound, a.issuedAt < q.askedAt, with zero tolerance, so an attester clock that is BEHIND the chain clock by more than the panel's processing time produces an attestation that the protocol verifier accepts but this contract rejects with InvalidAttestation.

Per the oracle-consumer reference a callback that reverts is recorded as not delivered and is not retried, and the price is already spent, so the asker loses 0.5 IMD and the question can only end as Unanswered. The check adds no security the contract does not already have: replay is prevented by _consume(a.requestId) plus the per-intake questionIdFor pairing, and the signature is over the request-specific UUID.

I measured the live Robinhood Chain head block timestamp at 1 second from wall clock, so the trigger requires the oracle host's clock to lag by more than the panel's turnaround; that is the specific state the finding depends on. Minimal fix that preserves the intent: a.issuedAt + ISSUED_AT_TOLERANCE < q.askedAt (symmetric with the forward tolerance), or drop the lower bound.

Boundary x invariant seam. The contract requires expiresAt - issuedAt <= requestedValidity where requestedValidity is the body's validForSeconds. Nothing in the oracle-consumer reference specifies how the oracle derives expiresAt from validForSeconds (whether from issuedAt, from the panel settlement time, or with second rounding); the canonical vector only shows one attestation with a 3600 s lifetime and does not show the body that produced it.

If the oracle's lifetime is validForSeconds + 1 (e.g. ceil on expiresAt, floor on issuedAt) or is measured from a settlement time earlier than issuedAt, the check fails for every request, not just an edge case, and each failure costs the asker 0.5 IMD with no retry.

The check protects nothing: a longer-lived signature is harmless because acceptance is already bounded by block.timestamp <= a.expiresAt, by the 24 h DeadlinePassed cut-off at line 149, and by _consume(a.requestId). The reference asks consumers to require agreed >= quorum and panel/quorum at least what was asked; it does not ask for a lifetime cap.

Minimal fix: drop the lifetime comparison, or compare with a tolerance (e.g. allow up to requestedValidity + ISSUED_AT_TOLERANCE).

Flow gap (execution x periphery x first principles). The brief says a request with no answer after 24 hours can be marked Unanswered by anyone. The implementation additionally refuses every callback once block.timestamp >= askedAt + 1 day, even when nobody has called markUnanswered and the record is still Pending.

The Intake calls the callback once inside a try with a 200k stipend and does not retry, so a correctly signed, in-window attestation that the oracle delivers at hour 24 or later is permanently lost: the asker paid 0.5 IMD, the oracle produced and signed the answer, and the contract throws it away. The owner can set validForSeconds up to 30 days, but the 24h constant still governs, so a longer requested validity does not widen the delivery window.

Accepting any callback while status == Pending (and leaving the 24h gate only on markUnanswered) keeps the brief's semantics and stores the paid answer; the only new race is between a late delivery and a permissionless markUnanswered, which is strictly better for the asker than today's guaranteed loss.

Economic Security / Flow gap: the brief asks the callback to verify the attestation, require bool type and agreed >= quorum; the reference adds panel and quorum at least what was asked.

The contract adds further gates whose inputs the contract does not control: (a) a.issuedAt < q.askedAt reverts with no tolerance, although the canonical verifier explicitly models attester-vs-chain clock skew and grants 5 minutes in the other direction; an attester wall clock a few seconds behind the sequencer's block timestamp, combined with a fast panel, refuses the answer.

(b) expiresAt - issuedAt > requestedValidity reverts, which assumes the plane sets expiresAt exactly as issuedAt + validForSeconds; if the plane anchors either stamp differently (e.g. expiry from request time plus validity but issuedAt at signing, or the reverse), every answer is refused. (c) a.chainId must equal 4663 and fromBlock <= toBlock, whose values for evidence "panel" are set by the plane, not the body.

Each gate is reached only after the fee was spent and inside the Intake's single non-retried try, so a mismatch converts a paid, signed answer into a 0.5 IMD loss per question; if the plane systematically produces such values the contract can never store any answer.

Whether the live plane produces such values could not be verified offline (no network fixture for the writer); treat (b) and (c) as leads that the author should confirm against a real attestation before launch, and (a) as a confirmed asymmetry with the canonical tolerance.

Minimal fix preserving intent: drop the issuedAt-vs-askedAt and lifetime-length gates (the canonical window check and the 24h deadline already bound staleness), or give issuedAt the same 5-minute tolerance the base verifier uses.

The brief says the callback must run "only for a pending request" and that a request with no answer after 24 hours "can be marked Unanswered by anyone". The implementation adds a second, independent cutoff: once block.timestamp reaches askedAt + 1 day, onOracleResult reverts DeadlinePassed even though q.status is still Pending and nobody has called markUnanswered.

Because the Intake runs the callback inside a try with no retry, a correctly signed, unexpired attestation that the writer lands one block too late is dropped permanently and the 0.5 IMD buys nothing. The Pending status alone already prevents any race with markUnanswered (a marked question reverts NotPending), so the extra time check only removes answers, never protects anything.

Execution trace: ask -> Intake.request (fee forwarded) -> [writer delay >= 24h] -> onOracleResult reverts at line 149 before _verifyAttestation -> status stays Pending -> any caller markUnanswered -> Unanswered, consumed[a.requestId] == false.

Documented privileged powers, not a permission bypass: (1) setProtocol may point intake at any nonzero address; every later ask reads priceOf from it, pulls that price from the caller and forwards it there, so a malicious or compromised owner redirects all future fees.

(2) setSigner may point oracleSigner at any key, so the owner can author answers for pending and future questions (also via its own intake address, since onOracleResult trusts whichever intake issued the request id). (3) owner is immutable with no handover, so a lost key permanently freezes signer/intake/panel rotation, and a protocol version change (oracle-2, moved Intake) would then require a redeploy.

(4) ask() has no caller-supplied price ceiling (the brief fixes the signature as ask(string)), so a user holding an unlimited IMD allowance to AskOracle is charged whatever priceOf returns at execution time, which the Intake operator or the owner (via setProtocol) can raise between approval and ask. (5) IMD or ETH sent directly to the contract is unrecoverable by design (no sweep).

All five are consistent with the brief's 'nothing else is privileged' and are listed in README.md; they are recorded here so the judge has the actors and preconditions.

Trust-gap seam (access x economics). The amount pulled from the caller is read live from intake.priceOf and is otherwise unbounded. Two privileged actors control that quote and neither is the caller: (a) the Intake operator, who can reprice oracle.request@oracle-1 at any time; (b) the contract owner, who can point intake at any contract via setProtocol (the setter is correctly onlyOwner, but it changes what ask charges).

The brief and README tell users to 'approve this contract first', and a wallet that approves more than one quote (the project's own tests approve 100 IMD) pays whatever is quoted at execution time, up to that allowance.

The supplied oracle-consumer reference keeps price as 'the owner's ceiling; a caller of ask() chooses neither, which is what makes it safe for anyone to trigger' and lists 'the asset and price (set together)' as owner-settable; this implementation deliberately dropped the ceiling (README: 'does not ... impose a separate owner price override'). Not an access-control bypass: the setters hold.

Reported as the material trust assumption the Pashov adapter asks to document, with the concrete overcharge path. Minimal fix that preserves the brief's 'price = Intake.priceOf' rule: an owner-settable maxPrice (constructor arg, e.g. 0.5e18) and if (price > maxPrice) revert InvalidPayment(); before the pull; or, if the design is kept, state in the README that callers must approve exactly the quote.

Asymmetry finding. The canonical _verifyAttestation tolerates the attester's wall clock being up to ISSUED_AT_TOLERANCE (5 min) ahead of the chain clock precisely because 'the attester stamps with its own wall clock; a block's timestamp is a validator's'.

The application then re-checks the same field in the other direction with no tolerance at all: a.issuedAt < q.askedAt reverts if the attester's clock is behind the sequencer's clock (Robinhood Chain is an Arbitrum-Orbit chain whose block.timestamp is sequencer-assigned and may run ahead of wall time) by more than the time between the ask and the signing.

The second clause compares the signed lifetime against validForSeconds with no slack; whether the live oracle signs expiresAt == issuedAt + validForSeconds exactly cannot be verified from this tree (the reference's own vector uses a 3600 s lifetime beside an example body asking for 900 s).

Neither check is in the brief ('verify the attestation, require bool type and agreed >= quorum, consume its id') nor in the reference's list of what a consumer should require (panel and quorum at least what was asked, agreed >= quorum). The reference warns that a callback that reverts 'is recorded as not delivered and is not retried', so each rejection converts a paid, honestly answered question into Unanswered with the fee spent.

Minimal fix that keeps the intent: drop the two clauses (expiry is already enforced by _verifyAttestation), or make them tolerant: a.issuedAt + ISSUED_AT_TOLERANCE < q.askedAt and compare validity only against an upper bound such as 30 days.

Merged from audit_math (2 findings), audit_economics (finding 2), audit_flow (finding 2) and audit_permissions (finding 2): one root cause, the extra clauses on lines 154-155. The brief asks the callback to 'verify the attestation, require bool type and agreed >= quorum, consume its id'; the reference adds 'panel and quorum at least what the contract asked for'.

Neither asks the consumer to compare issuedAt with the ask's block timestamp or to cap the signed lifetime at validForSeconds.

The canonical verifier (src/OracleAttestation.sol:131,161) explicitly budgets 5 minutes for the attester's wall clock sitting ahead of the chain clock because 'the attester stamps with its own wall clock; a block's timestamp is a validator's'; this contract re-checks the same field in the other direction with no tolerance, so an attester clock behind the sequencer's by more than the panel's turnaround yields an attestation the protocol verifier accepts and AskOracle rejects with InvalidAttestation.

The lifetime clause assumes the plane sets expiresAt == issuedAt + validForSeconds exactly; nothing in the pinned reference specifies that derivation (its vector only shows one 3600 s lifetime). Both clauses are reached only after the fee was forwarded and inside the Intake's single, non-retried try, so every false rejection turns a paid, correctly signed answer into a question that can only end Unanswered.

Neither clause protects anything the contract does not already have: staleness is bounded by _verifyAttestation's expiry check and the 24 h deadline; replay by _consume(a.requestId) and the Pending status. Whether the live plane ever produces such stamps could not be verified (no RPC for chain 4663 answered), so severity is low: loss of a paid answer under a specific, plausible oracle-side condition.

The same applies, as an unverified lead only, to the a.chainId == 4663 and fromBlock <= toBlock clauses on lines 152-154 for evidence 'panel'. Minimal fix preserving intent: drop both clauses, or make them tolerant (a.issuedAt + ISSUED_AT_TOLERANCE < q.askedAt, and compare the lifetime against an upper bound such as 30 days rather than exact equality with the request).

Merged from audit_economics (finding 1) and audit_flow (finding 1). The brief says the callback runs 'only from the Intake, only for a pending request' and that a request with no answer after 24 hours 'can be marked Unanswered by anyone'. The implementation adds an independent hard cutoff: once block.timestamp reaches askedAt + 1 day, onOracleResult reverts even though q.status is still Pending and nobody has called markUnanswered.

Because the Intake runs the callback once inside a try with a 200k stipend and does not retry, a correctly signed, unexpired attestation that the writer lands one block too late is lost permanently and the 0.5 IMD buys nothing; the answer stays Pending until anyone marks it Unanswered. The Pending check on line 148 alone already prevents any race with markUnanswered (a marked question reverts NotPending), so the extra time check only removes answers.

The owner may set validForSeconds up to 30 days, but the 1-day constant still governs delivery, so a longer requested validity does not widen the window. README documents the behaviour as intended; it is reported because it is stricter than the brief, converts a paid answer into a loss under a specific condition (slow oracle), and protects nothing.

Minimal fix preserving the design: remove the line-149 check and let Status.Pending gate delivery; markUnanswered keeps its 24 h gate (line 173).

Merged from audit_flow (finding 3), audit_permissions (findings 1 and 3). None is a permission bypass; the setters are correctly onlyOwner and the behaviour is what the brief asks for ('price = Intake.priceOf(action, IMD); pull exactly that from the caller'; owner may set Intake, signer, panel). Recorded so the actors and preconditions are explicit.

(1) setProtocol may point intake at any nonzero address; every later ask reads priceOf from it, pulls that amount from the caller and forwards it there, so a malicious or compromised owner redirects all future fees. (2) setSigner may point oracleSigner at any key, so the owner can author answers for pending and future questions.

(3) The amount pulled is read live from intake.priceOf with no caller- or owner-side ceiling; a wallet holding an allowance above one quote (the repo's own tests approve 100 IMD or type(uint256).max) pays whatever is quoted at execution time, up to that allowance, if the Intake operator reprices or the owner swaps the intake. README states the mitigation: approve exactly the quote.

(4) owner is immutable (line 63) with no transfer path; if the key is lost, the first protocol-side rotation of signer or action leaves the contract unable to receive answers while ask keeps accepting payments, and the reference's 'must not need a redeploy' promise cannot be kept. (5) IMD or ETH sent directly to the contract is unrecoverable by design (no sweep).

Rated info rather than low because every path requires a trusted actor (owner or Intake operator) to act against users, and the brief fixes the price rule and ownership model; an optional owner-settable maxPrice, Ownable2Step or a README statement that callers must approve exactly the quote would each reduce the exposure without changing the agreed design.