Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`BaseChainlinkFunctionsOracle::sendRequest` Uses `Inline` Instead of `DONHosted` Risking Exposure Of Sensitive Information

0xdarko

Summary

BaseChainlinkFunctionsOracle::sendRequest hardcodes Location.Inline when initializing requests, which exposes function source code and any sensitive data on-chain. Using Location.DONHosted would provide better security by storing code and secrets encrypted in the DON network.

Vulnerability Details

The sendRequest function initializes requests with Location.Inline:

[](https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/oracles/BaseChainlinkFunctionsOracle.sol#L59)

function sendRequest(
string calldata source,
FunctionsRequest.Location secretsLocation,
bytes calldata encryptedSecretsReference,
...
) external onlyOwner {
FunctionsRequest.Request memory req;
req.initializeRequest(
FunctionsRequest.Location.Inline, // Hardcoded to Inline
FunctionsRequest.CodeLanguage.JavaScript,
source
);

Using Location.Inline means:

  • The JavaScript source code is stored directly on-chain

  • Anyone can read the source code from transaction data

  • Any sensitive data or logic in the code is exposed

  • Secrets and API endpoints become public

Impact

  • Source code and logic are publicly visible

  • Potential exposure of sensitive data if included in source

Tools Used

Manual Review

Recommendations

Use Location.DONHosted for secure code storage:

function sendRequest(
string calldata source,
FunctionsRequest.Location secretsLocation,
bytes calldata encryptedSecretsReference,
...
) external onlyOwner {
FunctionsRequest.Request memory req;
req.initializeRequest(
- FunctionsRequest.Location.Inline,
+ FunctionsRequest.Location.DONHosted,
FunctionsRequest.CodeLanguage.JavaScript,
source
);

Benefits:

  • Code is stored encrypted on DON network

  • Sensitive logic remains private

Note: Using Location.DONHosted requires maintaining a minimum balance in the Chainlink subscription for storing encrypted code and secrets.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.