fix(audit-low): code-correctness sweep — 10 LOW findings in one pass

- #36: OracleRegistry.setOracleBulk gains MAX_BULK_LENGTH = 256 cap +
  BulkLengthExceeded(length, max) error.
- #37 / #38 / #155: OracleUnifiedDeployer + MultiOracleUnifiedDeployer
  gain symmetric zero-address guards on every LibProdDeploy
  sub-deployer constant with typed errors (Pyth/Morpho/Passthrough on
  the single-feed deployer; Morpho/Passthrough extended onto the
  multi-feed deployer alongside the existing MultiPyth guard).
- #40: Deployment(...) event params indexed across all 5
  *BeaconSetDeployer + both *UnifiedDeployer.
- #41 / #179 / #180: MultiPythOracleAdapter._setFeeds validates all
  entries before mutating, writes feedCount last, and internalises
  MAX_FEEDS / non-empty checks so initialize and setFeeds become
  thin wrappers.
- #43: BasePythOracleAdapter.latestRoundData encodes
  uint80(uint64(publishTime)) into roundId and answeredInRound
  for Chainlink monotonic-id convention.
- #148: BasePythOracleAdapter enforces the "immutable after
  initialize" invariant on CorporateActionPauseConfig with a
  one-shot flag + CorporateActionConfigAlreadyInitialized error.
- #149: CorporateActionPauseConfigSet event emitted from
  _setCorporateActionPauseConfig so indexers observe the install.
- #173: Deployment event param renamed `sender` → `caller` across
  all 5 BeaconSetDeployer + both UnifiedDeployer (NatSpec @param
  describes it as the direct on-chain caller).

All behaviour changes have a test that fails against pre-fix and
passes after. forge build / fmt / slither / REUSE green. Test count
delta: 214 → 231 (+17).

Closes #36, #37, #38, #40, #41, #43, #148, #149, #155, #173, #179, #180.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Jai

src/abstract/BasePythOracleAdapter.sol

@@ -47,6 +47,12 @@ error VaultSharePriceOverflow(uint256 price8);
 /// source (Pyth's own getPriceAtPublishTime, an indexer, etc.).
 error HistoricalRoundDataUnsupported(uint80 roundId);
 
+/// @dev Error raised when `_setCorporateActionPauseConfig` is called more than
+/// once. Enforces the SPEC §16.2 "immutable after initialize" invariant on the
+/// four corporate-action pause storage slots so subclass discipline cannot
+/// silently break it.
+error CorporateActionConfigAlreadyInitialized();
+
 /// @title CorporateActionPauseConfig
 /// @notice Configuration for the corporate-action-aware auto-pause feature.
 /// All fields are immutable after initialize — see SPEC § 16.2.
@@ -113,13 +119,35 @@ abstract contract BasePythOracleAdapter is AggregatorV2V3Interface {
     /// pausing. Immutable.
     uint64 public pauseTimeAfter;
 
+    /// @dev True once `_setCorporateActionPauseConfig` has run. The four
+    /// corporate-action pause slots become immutable thereafter — any second
+    /// call reverts with `CorporateActionConfigAlreadyInitialized`. Subclass
+    /// initializers MUST call the helper exactly once. Packed alongside
+    /// `pauseTimeBefore` and `pauseTimeAfter` in the same storage slot
+    /// (8 + 8 + 1 bytes ≪ 32), so the new invariant costs no extra slot.
+    bool internal _corporateActionConfigInitialized;
+
     /// @notice Emitted when the manual pause state changes.
     /// @param isPaused The new pause state.
     event PauseSet(bool isPaused);
     /// @notice Emitted when the admin is changed.
     /// @param oldAdmin The previous admin address.
     /// @param newAdmin The new admin address.
     event AdminSet(address indexed oldAdmin, address indexed newAdmin);
+    /// @notice Emitted exactly once on initialize to record the corporate-action
+    /// auto-pause config. Lets off-chain indexers reconstruct an oracle's
+    /// full governance state from event logs alone, without per-oracle storage
+    /// reads.
+    /// @param corporateActionsVault Address implementing `ICorporateActionsV1`,
+    /// or `address(0)` to disable auto-pause.
+    /// @param actionTypeMask Bitmap of action types that trigger an auto-pause.
+    /// @param pauseTimeBefore Seconds before a pending action's `effectiveTime`
+    /// to start pausing.
+    /// @param pauseTimeAfter Seconds after a completed action's `effectiveTime`
+    /// to keep pausing.
+    event CorporateActionPauseConfigSet(
+        address corporateActionsVault, uint256 actionTypeMask, uint64 pauseTimeBefore, uint64 pauseTimeAfter
+    );
 
     modifier onlyAdmin() {
         if (msg.sender != admin) revert OnlyAdmin();
@@ -151,6 +179,13 @@ abstract contract BasePythOracleAdapter is AggregatorV2V3Interface {
     }
 
     /// @inheritdoc AggregatorV2V3Interface
+    /// @dev `roundId` and `answeredInRound` are derived from the Pyth
+    /// `publishTime` (truncated to `uint80`) so they advance monotonically per
+    /// Chainlink convention without adding storage. Integrators that diff
+    /// `roundId` between calls to detect a fresh update will see a different
+    /// value whenever Pyth has produced a new price. The truncation collision
+    /// is far in the future — `uint80` covers more seconds than any plausible
+    /// deployment lifetime.
     // slither-disable-next-line pyth-unchecked-confidence
     function latestRoundData()
         external
@@ -163,7 +198,14 @@ abstract contract BasePythOracleAdapter is AggregatorV2V3Interface {
         PythStructs.Price memory priceData = _getPriceData();
         int256 scaledPrice = _vaultSharePrice(priceData);
 
-        return (1, scaledPrice, uint256(uint64(priceData.publishTime)), uint256(uint64(priceData.publishTime)), 1);
+        uint80 publishRoundId = uint80(uint64(priceData.publishTime));
+        return (
+            publishRoundId,
+            scaledPrice,
+            uint256(uint64(priceData.publishTime)),
+            uint256(uint64(priceData.publishTime)),
+            publishRoundId
+        );
     }
 
     /// @inheritdoc AggregatorV2V3Interface
@@ -220,12 +262,21 @@ abstract contract BasePythOracleAdapter is AggregatorV2V3Interface {
     /// `corporateActionsVault == address(0)` disables auto-pause for the
     /// life of the proxy and is the right choice when an oracle is
     /// redeployed against a vault that hasn't yet been upgraded to expose
-    /// `ICorporateActionsV1`.
+    /// `ICorporateActionsV1`. Reverts with
+    /// `CorporateActionConfigAlreadyInitialized` if called a second time —
+    /// the four corporate-action pause slots are SPEC §16.2 immutable.
+    /// Emits `CorporateActionPauseConfigSet` so off-chain indexers can
+    /// reconstruct the config from logs alone.
     function _setCorporateActionPauseConfig(CorporateActionPauseConfig memory config) internal {
+        if (_corporateActionConfigInitialized) revert CorporateActionConfigAlreadyInitialized();
+        _corporateActionConfigInitialized = true;
         corporateActionsVault = config.corporateActionsVault;
         actionTypeMask = config.actionTypeMask;
         pauseTimeBefore = config.pauseTimeBefore;
         pauseTimeAfter = config.pauseTimeAfter;
+        emit CorporateActionPauseConfigSet(
+            config.corporateActionsVault, config.actionTypeMask, config.pauseTimeBefore, config.pauseTimeAfter
+        );
     }
 
     /// @dev Computes conservative price (price - confidence) as a Rain Float.

src/concrete/deploy/MorphoProtocolAdapterBeaconSetDeployer.sol

@@ -37,8 +37,14 @@ struct MorphoProtocolAdapterBeaconSetDeployerConfig {
 /// retains no authority over the beacon after construction. Used for Morpho
 /// Blue protocol integration.
 contract MorphoProtocolAdapterBeaconSetDeployer {
-    /// Emitted when a new MorphoProtocolAdapter is deployed.
-    event Deployment(address sender, address morphoProtocolAdapter);
+    /// @notice Emitted when a new MorphoProtocolAdapter is deployed.
+    /// @param caller The direct on-chain caller of `newMorphoProtocolAdapter`.
+    /// For adapters created via `OracleUnifiedDeployer` /
+    /// `MultiOracleUnifiedDeployer` this is the unified-deployer contract, not
+    /// the originating EOA. Indexed so monitoring can filter by deployer.
+    /// @param morphoProtocolAdapter The address of the new proxy. Indexed so
+    /// monitoring can filter by adapter.
+    event Deployment(address indexed caller, address indexed morphoProtocolAdapter);
 
     /// The beacon for the MorphoProtocolAdapter implementation contracts.
     IBeacon public immutable I_MORPHO_PROTOCOL_ADAPTER_BEACON;

src/concrete/deploy/MultiOracleUnifiedDeployer.sol

@@ -22,6 +22,14 @@ import {LibProdDeploy} from "src/lib/LibProdDeploy.sol";
 /// set in LibProdDeploy.
 error MultiPythBeaconSetDeployerNotSet();
 
+/// @dev Error raised when the `MorphoProtocolAdapterBeaconSetDeployer` address
+/// in `LibProdDeploy` is unset (zero) on the current chain.
+error MorphoBeaconSetDeployerNotSet();
+
+/// @dev Error raised when the `PassthroughProtocolAdapterBeaconSetDeployer`
+/// address in `LibProdDeploy` is unset (zero) on the current chain.
+error PassthroughBeaconSetDeployerNotSet();
+
 /// @title MultiOracleUnifiedDeployer
 /// @notice Atomically deploys a MultiPythOracleAdapter and all protocol
 /// adapters (Morpho, Passthrough for Aave/Compound) for a new vault. Mirrors
@@ -38,14 +46,18 @@ error MultiPythBeaconSetDeployerNotSet();
 /// replaced. There is no on-chain pointer to chase. Tracked at #209.
 contract MultiOracleUnifiedDeployer {
     /// @notice Emitted when a new multi-feed oracle and protocol adapter set is deployed.
-    /// @param sender The caller that triggered the deployment.
+    /// @param caller The direct on-chain caller of
+    /// `newMultiOracleAndProtocolAdapters` — typically the originating EOA,
+    /// but if this contract is itself wrapped behind another deployer it will
+    /// be that intermediate contract, not the EOA. Indexed so monitoring can
+    /// filter by deployer.
     /// @param multiPythOracleAdapter The address of the new MultiPythOracleAdapter proxy.
     /// @param morphoProtocolAdapter The address of the new MorphoProtocolAdapter proxy.
     /// @param passthroughProtocolAdapter The address of the new PassthroughProtocolAdapter proxy.
     event Deployment(
-        address sender,
-        address multiPythOracleAdapter,
-        address morphoProtocolAdapter,
+        address indexed caller,
+        address indexed multiPythOracleAdapter,
+        address indexed morphoProtocolAdapter,
         address passthroughProtocolAdapter
     );
 
@@ -68,6 +80,12 @@ contract MultiOracleUnifiedDeployer {
         if (LibProdDeploy.MULTI_PYTH_ORACLE_ADAPTER_BEACON_SET_DEPLOYER == address(0)) {
             revert MultiPythBeaconSetDeployerNotSet();
         }
+        if (LibProdDeploy.MORPHO_PROTOCOL_ADAPTER_BEACON_SET_DEPLOYER == address(0)) {
+            revert MorphoBeaconSetDeployerNotSet();
+        }
+        if (LibProdDeploy.PASSTHROUGH_PROTOCOL_ADAPTER_BEACON_SET_DEPLOYER == address(0)) {
+            revert PassthroughBeaconSetDeployerNotSet();
+        }
 
         // 1. Deploy multi-feed oracle adapter
         MultiPythOracleAdapter oracleAdapter = MultiPythOracleAdapterBeaconSetDeployer(

src/concrete/deploy/MultiPythOracleAdapterBeaconSetDeployer.sol

@@ -36,8 +36,14 @@ struct MultiPythOracleAdapterBeaconSetDeployerConfig {
 /// contract retains no authority over the beacon after construction.
 /// Follows the st0x.deploy BeaconSetDeployer pattern.
 contract MultiPythOracleAdapterBeaconSetDeployer {
-    /// Emitted when a new MultiPythOracleAdapter is deployed.
-    event Deployment(address sender, address multiPythOracleAdapter);
+    /// @notice Emitted when a new MultiPythOracleAdapter is deployed.
+    /// @param caller The direct on-chain caller of `newMultiPythOracleAdapter`.
+    /// For adapters created via `MultiOracleUnifiedDeployer` this is the
+    /// unified-deployer contract, not the originating EOA. Indexed so
+    /// monitoring can filter by deployer.
+    /// @param multiPythOracleAdapter The address of the new proxy. Indexed so
+    /// monitoring can filter by adapter.
+    event Deployment(address indexed caller, address indexed multiPythOracleAdapter);
 
     /// The beacon for the MultiPythOracleAdapter implementation contracts.
     IBeacon public immutable I_MULTI_PYTH_ORACLE_ADAPTER_BEACON;

src/concrete/deploy/OracleRegistryBeaconSetDeployer.sol

@@ -36,8 +36,13 @@ struct OracleRegistryBeaconSetDeployerConfig {
 /// post-construction authority over the beacon. Follows the st0x.deploy
 /// BeaconSetDeployer pattern.
 contract OracleRegistryBeaconSetDeployer {
-    /// Emitted when a new OracleRegistry is deployed.
-    event Deployment(address sender, address oracleRegistry);
+    /// @notice Emitted when a new OracleRegistry is deployed.
+    /// @param caller The direct on-chain caller of `newOracleRegistry`. Also
+    /// becomes the registry admin per SPEC §13. Indexed so monitoring can
+    /// filter by deployer.
+    /// @param oracleRegistry The address of the new proxy. Indexed so
+    /// monitoring can filter by registry.
+    event Deployment(address indexed caller, address indexed oracleRegistry);
 
     /// The beacon for the OracleRegistry implementation contracts.
     IBeacon public immutable I_ORACLE_REGISTRY_BEACON;

src/concrete/deploy/OracleUnifiedDeployer.sol

@@ -14,6 +14,18 @@ import {MorphoProtocolAdapter} from "src/concrete/protocol/MorphoProtocolAdapter
 import {OracleRegistry} from "src/concrete/registry/OracleRegistry.sol";
 import {LibProdDeploy} from "src/lib/LibProdDeploy.sol";
 
+/// @dev Error raised when the `PythOracleAdapterBeaconSetDeployer` address in
+/// `LibProdDeploy` is unset (zero) on the current chain.
+error PythBeaconSetDeployerNotSet();
+
+/// @dev Error raised when the `MorphoProtocolAdapterBeaconSetDeployer` address
+/// in `LibProdDeploy` is unset (zero) on the current chain.
+error MorphoBeaconSetDeployerNotSet();
+
+/// @dev Error raised when the `PassthroughProtocolAdapterBeaconSetDeployer`
+/// address in `LibProdDeploy` is unset (zero) on the current chain.
+error PassthroughBeaconSetDeployerNotSet();
+
 /// @title OracleUnifiedDeployer
 /// @notice Atomically deploys a PythOracleAdapter and all protocol adapters
 /// (Morpho, Passthrough for Aave/Compound) for a new vault. The beacon set
@@ -28,12 +40,18 @@ import {LibProdDeploy} from "src/lib/LibProdDeploy.sol";
 /// replaced. There is no on-chain pointer to chase. Tracked at #209.
 contract OracleUnifiedDeployer {
     /// @notice Emitted when a new oracle and protocol adapter set is deployed.
-    /// @param sender The caller that triggered the deployment.
+    /// @param caller The direct on-chain caller of `newOracleAndProtocolAdapters`
+    /// — typically the originating EOA, but if this contract is itself wrapped
+    /// behind another deployer it will be that intermediate contract, not the
+    /// EOA. Indexed so monitoring can filter by deployer.
     /// @param pythOracleAdapter The address of the new PythOracleAdapter proxy.
     /// @param morphoProtocolAdapter The address of the new MorphoProtocolAdapter proxy.
     /// @param passthroughProtocolAdapter The address of the new PassthroughProtocolAdapter proxy.
     event Deployment(
-        address sender, address pythOracleAdapter, address morphoProtocolAdapter, address passthroughProtocolAdapter
+        address indexed caller,
+        address indexed pythOracleAdapter,
+        address indexed morphoProtocolAdapter,
+        address passthroughProtocolAdapter
     );
 
     /// @notice Deploy oracle + all protocol adapters for a new vault.
@@ -54,6 +72,20 @@ contract OracleUnifiedDeployer {
         OracleRegistry registry,
         CorporateActionPauseConfig calldata pauseConfig
     ) external {
+        // Pre-flight: every LibProdDeploy sub-deployer address must be set on
+        // the current chain. Surface a typed error so a partial deployment or
+        // wrong-chain invocation fails loudly rather than reverting deep
+        // inside an ABI decode of an empty extcall return.
+        if (LibProdDeploy.PYTH_ORACLE_ADAPTER_BEACON_SET_DEPLOYER == address(0)) {
+            revert PythBeaconSetDeployerNotSet();
+        }
+        if (LibProdDeploy.MORPHO_PROTOCOL_ADAPTER_BEACON_SET_DEPLOYER == address(0)) {
+            revert MorphoBeaconSetDeployerNotSet();
+        }
+        if (LibProdDeploy.PASSTHROUGH_PROTOCOL_ADAPTER_BEACON_SET_DEPLOYER == address(0)) {
+            revert PassthroughBeaconSetDeployerNotSet();
+        }
+
         // 1. Deploy oracle adapter
         PythOracleAdapter oracleAdapter = PythOracleAdapterBeaconSetDeployer(
                 LibProdDeploy.PYTH_ORACLE_ADAPTER_BEACON_SET_DEPLOYER

src/concrete/deploy/PassthroughProtocolAdapterBeaconSetDeployer.sol

@@ -41,8 +41,15 @@ struct PassthroughProtocolAdapterBeaconSetDeployerConfig {
 /// contract retains no authority over the beacon after construction. Used
 /// for Aave V3, Compound V3, and any future Chainlink-compatible protocol.
 contract PassthroughProtocolAdapterBeaconSetDeployer {
-    /// Emitted when a new PassthroughProtocolAdapter is deployed.
-    event Deployment(address sender, address passthroughProtocolAdapter);
+    /// @notice Emitted when a new PassthroughProtocolAdapter is deployed.
+    /// @param caller The direct on-chain caller of
+    /// `newPassthroughProtocolAdapter`. For adapters created via
+    /// `OracleUnifiedDeployer` / `MultiOracleUnifiedDeployer` this is the
+    /// unified-deployer contract, not the originating EOA. Indexed so
+    /// monitoring can filter by deployer.
+    /// @param passthroughProtocolAdapter The address of the new proxy. Indexed
+    /// so monitoring can filter by adapter.
+    event Deployment(address indexed caller, address indexed passthroughProtocolAdapter);
 
     /// The beacon for the PassthroughProtocolAdapter implementation contracts.
     IBeacon public immutable I_PASSTHROUGH_PROTOCOL_ADAPTER_BEACON;

src/concrete/deploy/PythOracleAdapterBeaconSetDeployer.sol

@@ -36,8 +36,14 @@ struct PythOracleAdapterBeaconSetDeployerConfig {
 /// retains no authority over the beacon after construction. Follows the
 /// st0x.deploy BeaconSetDeployer pattern.
 contract PythOracleAdapterBeaconSetDeployer {
-    /// Emitted when a new PythOracleAdapter is deployed.
-    event Deployment(address sender, address pythOracleAdapter);
+    /// @notice Emitted when a new PythOracleAdapter is deployed.
+    /// @param caller The direct on-chain caller of `newPythOracleAdapter`. For
+    /// adapters created via `OracleUnifiedDeployer` /
+    /// `MultiOracleUnifiedDeployer` this is the unified-deployer contract, not
+    /// the originating EOA. Indexed so monitoring can filter by deployer.
+    /// @param pythOracleAdapter The address of the new proxy. Indexed so
+    /// monitoring can filter by adapter.
+    event Deployment(address indexed caller, address indexed pythOracleAdapter);
 
     /// The beacon for the PythOracleAdapter implementation contracts.
     IBeacon public immutable I_PYTH_ORACLE_ADAPTER_BEACON;

src/concrete/oracle/MultiPythOracleAdapter.sol

@@ -119,8 +119,6 @@ contract MultiPythOracleAdapter is BasePythOracleAdapter, ICloneableV2, Initiali
 
         if (config.vault == address(0)) revert ZeroVault();
         if (config.admin == address(0)) revert ZeroAdmin();
-        if (config.feeds.length == 0) revert ZeroFeeds();
-        if (config.feeds.length > MAX_FEEDS) revert TooManyFeeds();
 
         vault = config.vault;
         admin = config.admin;
@@ -136,8 +134,6 @@ contract MultiPythOracleAdapter is BasePythOracleAdapter, ICloneableV2, Initiali
     /// @notice Update the entire feed list. Admin only.
     /// @param feeds The new ordered feed configurations.
     function setFeeds(FeedConfig[] calldata feeds) external onlyAdmin {
-        if (feeds.length == 0) revert ZeroFeeds();
-        if (feeds.length > MAX_FEEDS) revert TooManyFeeds();
         _setFeeds(feeds);
         emit FeedsSet(feeds);
     }
@@ -225,18 +221,37 @@ contract MultiPythOracleAdapter is BasePythOracleAdapter, ICloneableV2, Initiali
         }
     }
 
-    /// @dev Internal feed setter. Validates and stores feeds.
+    /// @dev Internal feed setter. Validates every entry and the length bounds
+    /// up front, then mutates storage. The validate-then-mutate ordering means
+    /// a bad input never partially clobbers existing feeds — important even
+    /// though Solidity reverts roll back state today, because it keeps the
+    /// helper composable into future delegatecall / multi-call contexts where
+    /// partial reverts would otherwise leak. Length checks are folded in so
+    /// `initialize` and `setFeeds` become thin wrappers and any future internal
+    /// caller is also bound by `MAX_FEEDS` / non-empty.
     function _setFeeds(FeedConfig[] memory feeds) internal {
+        // Validate length bounds first.
+        if (feeds.length == 0) revert ZeroFeeds();
+        if (feeds.length > MAX_FEEDS) revert TooManyFeeds();
+
+        // Validate each entry before any storage write.
+        for (uint256 i = 0; i < feeds.length; i++) {
+            if (feeds[i].priceId == bytes32(0)) revert ZeroPriceId(i);
+            if (feeds[i].maxAge == 0) revert ZeroMaxAge(i);
+        }
+
+        // Mutate: clear tail of old entries that no longer fit, then write new
+        // entries, then update `feedCount` last so an external reader can
+        // never observe a length without its slot also populated.
         uint256 oldCount = feedCount;
         for (uint256 i = feeds.length; i < oldCount; i++) {
             delete _feeds[i];
         }
 
-        feedCount = feeds.length;
         for (uint256 i = 0; i < feeds.length; i++) {
-            if (feeds[i].priceId == bytes32(0)) revert ZeroPriceId(i);
-            if (feeds[i].maxAge == 0) revert ZeroMaxAge(i);
             _feeds[i] = feeds[i];
         }
+
+        feedCount = feeds.length;
     }
 }