LidoOracle contract allows reporting non-finalized epochs

[skozin]

The code for determining the last reportable epoch is the following:

/**
 * @notice Returns the fisrt and last epochs that can be reported
 */
function getCurrentReportableEpochs()
    public view
    returns (
        uint256 firstReportableEpochId,
        uint256 lastReportableEpochId
    )
{
    return (earliestReportableEpochId, getCurrentEpochId());
}

/**
 * @notice Returns the epochId calculated from current timestamp
 */
function getCurrentEpochId() public view returns (uint256) {
    return (
        _getTime()
        .sub(beaconSpec.genesisTime)
        .div(beaconSpec.slotsPerEpoch)
        .div(beaconSpec.secondsPerSlot)
    );
}

The problem is that the current epoch is not yet finalized: for that, two more epochs should pass, so oracles should be prohibited from reporting it.

[vshvsh]

That's a very minor issue. While technically true it's non-exploitable with majority of honest (even if buggy) oracles and irrelevant otherwise.