perf(oracle): pack price feed rounds

[ByteYue]

Summary

Implements the contract half of Galxe/gravity-audit#1092 before the price-feed feature is activated:

• accept only the canonical 32-byte packed Price Feed V1 callback body
• fix price precision at 8 decimals and use unsigned bounded fields
• store each latest round in one mapping value slot
• enforce exact length, version, flags, source identity, monotonic round/time, and positive price
• permanently bind each source type 3 feed ID to its first task config hash
• reject the undeployed legacy 160-byte callback body

Packed layout:

version:u8 | feedId:u64 | roundId:u32 | resolvedAtMs:u48 | price:u96 | flags:u8

Golden inner payload:

0100000000000007d101b2e020018e23f2365f0000000000000009543637a800

Design notes

This is intentionally a packed-only predeployment change. No legacy decoder, storage migration, or old getter/event compatibility is added.

The config binding is deliberately stricter than the minimum semantic invariant in #1092: all raw config bytes are immutable for a price-feed ID, including graceMs. Any config change must use a new feed ID. This avoids parsing provider URIs on chain and fails closed against historical feed reinterpretation.

Polymarket contracts are unchanged.

Verification

• forge fmt --check
• forge test --match-path 'test/unit/oracle/PriceFeedResolver.t.sol': 20 passed
• forge test --match-path 'test/unit/oracle/OracleTaskConfig.t.sol': 36 passed
• all oracle unit suites: 325 passed
• full Forge suite: 0 failures
• forge inspect ... storage-layout --json: PriceRound occupies one slot

Rollout

Merge this contract format first, then the matching gravity-reth producer, then update gravity-sdk E2E/soak coverage. Do not enable a price-feed task until all participating validators run the packed producer.

[github-actions]

🛡️ Security Audit Results

Security Audit Summary

Generated on: Sun Aug 9 18:01:48 UTC 2026
Commit: df9a688
Branch: 116/merge

Tools Executed

• ✅ Slither: 1 reports
• ✅ Mythril: 1 reports
• ✅ 4naly3er: 1 reports
• ✅ Aderyn: 0 reports

Next Steps

1. Review all generated reports in the audit/ directory
2. Prioritize High and Medium severity issues
3. Address findings before deployment
4. Consider additional manual security review

📁 Full reports available in GitHub Actions Artifacts