Integer overflow in oracle pallet in spacewalk

Context

Issue found by SRL labs in the semi-automated audit.

Summary

An integer overflow in the oracle pallet can be abused by a malicious oracle.

Issue details

There is an integer overflow inside the oracle::begin_block function which is called upon block initialization. A malicious oracle can trigger this overflow by updating the coin info with high supply and price values via set_updated_coin_infos call inside Pendulum's dia-oracle pallet.

Here is an example call parameters that will trigger the overflow in the next block initialization:

RuntimeCall::DiaOracleModule(Call::set_updated_coin_infos {
    coin_infos: [(
        ([0], [0]),
        CoinInfo {
            symbol: [],
            name: [0],
            blockchain: [],
            supply: 45172881575663848363994640109535494224,
            last_update_timestamp: 60000533389444330,
            price: 338974337383797358236404514952583315520,
        })]
});

Risk

By triggering this integer overflow, a malicious oracle can:

Crash the nodes compiled in debug mode with overflow checks enabled
On nodes which have overflow checks disabled, unexpected behaviors and logic inconsistencies
We assigned a severity of low to this issue since it can only be triggered by permissioned oracles.

Mitigation

Implement proper integer overflow handling by checking call arguments and using safe arithmetic functions.

Start in pallets/oracle/src/lib.rs at oracle::begin_block, then trace the values supplied through pallets/dia-oracle/src/lib.rs by set_updated_coin_infos. Verify the reported overflow with the example coin information and ensure the arithmetic and call arguments handle extreme values safely; done means block initialization no longer overflows or produces unexpected behavior.