Core Contracts

Summary

The sendRequest function in BaseChainlinkFunctionsOracle hardcodes the codeLocation to Inline, preventing the use of remote or DON-hosted code. This limits the oracle's ability to handle larger or dynamically updated scripts, reducing functionality and flexibility.

Vulnerability Details

In BaseChainlinkFunctionsOracle.sol, the sendRequest function initializes the Chainlink Functions request with a hardcoded codeLocation set to Inline (via req.initializeRequest). This forces all requests to use inline JavaScript, even if the intended code is hosted remotely or on the DON. The secretsLocation parameter is correctly passed, but the codeLocation is not, creating a mismatch in configuration flexibility.

Chainlink Functions supports three codeLocation types: Inline, Remote, and DONHosted. Hardcoding to Inline makes it impossible to leverage remote sources (URLs) or DON-hosted code.

This creates a situation where the contract accepts configurations that are inherently incompatible according to the underlying library's design.

Impact

Contracts inheriting BaseChainlinkFunctionsOracle such as RAACHousePriceOracle and RAACPrimeRateOracle cannot execute code from remote URLs or DON-hosted storage

Tools Used

Manual review

Recommendations

Modify the sendRequest function in BaseChainlinkFunctionsOracle to accept codeLocation as a parameter, allowing the caller to correctly specify the location of the code (Inline, Remote, or DONHosted) based on whether or not secrets are used and where the code and secrets are stored.