Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Input Validation in setDonId Allows Setting an Empty DON ID, Potentially Disrupting Oracle Functionality

cz_moose

Summary

The BaseChainlinkFunctionsOracle::setDonId function lacks proper input validation, allowing the contract owner to set an empty DON ID (""). This can disrupt oracle functionality, leading to potential failures in fetching external data and affecting contracts relying on the oracle

Vulnerability Details

The function setDonId updates the donId variable but does not verify whether the provided newDonId is empty.

abstract contract BaseChainlinkFunctionsOracle is FunctionsClient, ConfirmedOwner {
// [...]
constructor(address router, bytes32 _donId) FunctionsClient(router) ConfirmedOwner(msg.sender) {
require(_donId != "", "DON ID must be set");
donId = _donId;
}
​
/**
* @notice Set the DON ID
* @param newDonId New DON ID
*/
@> function setDonId(bytes32 newDonId) external onlyOwner {
donId = newDonId;
}
​
// [...]
}

If the owner mistakenly sets donId to an empty value (""), oracle requests relying on this identifier may fail, causing potential disruptions in the system.

Impact

  • Disrupted Oracle Operations: If an empty donId is set, the contract may fail to interact with Chainlink’s decentralized oracle network (DON), rendering the oracle ineffective

  • Failed External Data Requests: Any contract dependent on this oracle for real-time data (e.g., price feeds, off-chain computations) could be unable to retrieve necessary information

  • Increased Manual Intervention: Fixing the issue requires the owner to identify the problem and manually set a valid donId, potentially delaying critical operations.

Tools Used

  • Manual code review

Recommendations

To prevent this issue, add an input validation check in setDonId:

abstract contract BaseChainlinkFunctionsOracle is FunctionsClient, ConfirmedOwner {
// [...]
constructor(address router, bytes32 _donId) FunctionsClient(router) ConfirmedOwner(msg.sender) {
require(_donId != "", "DON ID must be set");
donId = _donId;
}
​
/**
* @notice Set the DON ID
* @param newDonId New DON ID
*/
function setDonId(bytes32 newDonId) external onlyOwner {
+ require(newDonId != "", "DON ID must be set");
donId = newDonId;
}
​
// [...]
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!