Created using remix-ide: Realtime Ethereum Contract Compiler and Runtime. Load this file by pasting this gists URL or ID at https://remix.ethereum.org/#version=soljson-v0.7.6+commit.7338295f.js&optimize=false&runs=200&gist=

ibport-bare.sol

pragma solidity <=0.7;

abstract contract Ownable {
  address private _owner;
  address private _admin;

  constructor () internal {
    _owner = msg.sender;
    _admin = msg.sender;
  }

  modifier onlyOwner() {
    require(_owner == msg.sender || _admin == msg.sender, "Ownable: caller is not the owner or admin");
    _;
  }

  function transferOwnership(address newOwner) external virtual onlyOwner {
    require(newOwner != address(0), "Ownable: new owner is the zero address");
    _owner = newOwner;
  }
}

interface ISubscriberBytes {
    function attachValue() external;
}

contract IBPort is ISubscriberBytes, Ownable {
    address public nebula;
    uint public counter;

    constructor(address _nebula) public {
        nebula = _nebula;
    }

    function attachValue() override external {
        require(msg.sender == nebula, "access denied");
        mint();
    }

    function mint() internal {
        // TODO: add 1
        counter++;
    }
}

malicious.sol

pragma solidity <=0.7;

abstract contract Ownable {
  address private _owner;
  address private _admin;

  constructor () internal {
    _owner = msg.sender;
    _admin = msg.sender;
  }

  modifier onlyOwner() {
    require(_owner == msg.sender || _admin == msg.sender, "Ownable: caller is not the owner or admin");
    _;
  }

  function transferOwnership(address newOwner) external virtual onlyOwner {
    require(newOwner != address(0), "Ownable: new owner is the zero address");
    _owner = newOwner;
  }
}

interface ISubscriberBytes {
    function attachValue() external;
}

contract IBPort is ISubscriberBytes, Ownable {
    address public nebula;
    uint public counter;
    address public ibport;

    constructor(address _nebula, address _ibport) public {
        nebula = _nebula;
        ibport = _ibport;
    }

    function attachValue() override external {
        require(msg.sender == nebula, "access denied");
        mint();
        (bool success, bytes memory result) = ibport.delegatecall(abi.encodeWithSignature("attachValue()"));
    }

    function mint() internal {
        // TODO: add 1
        counter++;
    }
}

nebula-bare.sol

pragma solidity <=0.7;

library QueueLib {
    struct Queue {
        bytes32 first;
        bytes32 last;
        mapping(bytes32 => bytes32) nextElement;
        mapping(bytes32 => bytes32) prevElement;
    }

    function push(Queue storage queue, bytes32 elementHash) public {
        if (queue.first == 0x000) {
            queue.first = elementHash;
            queue.last = elementHash;
        } else {
            queue.nextElement[queue.last] = elementHash;
            queue.prevElement[elementHash] = queue.last;
            queue.nextElement[elementHash] = bytes32(0);
            queue.last = elementHash;
        }
    }
}

library NModels {
    uint8 constant oracleCountInEpoch = 5;

    enum DataType {
        Int64,
        String,
        Bytes
    }

    struct Subscription {
        address owner;
        address payable contractAddress;
        uint8 minConfirmations;
        uint256 reward;
    }

    struct Pulse {
        bytes32 dataHash;
        uint256 height;
    }

    struct Oracle {
        address owner;
        bool isOnline;
        bytes32 idInQueue;
    }
}

interface ISubscriberBytes {
    function attachValue() external;
}

contract Nebula {
    event NewSubscriber(bytes32 id);

    QueueLib.Queue public subscriptionsQueue;

    address public oracle;

    bytes32[] public subscriptionIds;
    mapping(bytes32 => NModels.Subscription) public subscriptions;

    constructor() public {
        oracle = msg.sender;
    }

    receive() external payable { }

    function sendValueToSubByte(bytes32 subId) public {
        require(oracle == msg.sender, "caller is not one of the oracles");

        ISubscriberBytes(subscriptions[subId].contractAddress).attachValue();
    }

    function subscribe(address payable contractAddress, uint8 minConfirmations, uint256 reward) public {
        bytes32 id = keccak256(abi.encodePacked(abi.encodePacked(msg.sig, msg.sender, contractAddress, minConfirmations)));
        require(subscriptions[id].owner == address(0x00), "rq exists");
        subscriptions[id] = NModels.Subscription(msg.sender, contractAddress, minConfirmations, reward);
        QueueLib.push(subscriptionsQueue, id);
        subscriptionIds.push(id);
        emit NewSubscriber(id);
    }
}