Submission Details
Severity:
Lack of validate newDonId in `setDonId` function
Summary
In the constructor have check condition require(_donId != "", "DON ID must be set");
But in the setDonId function don't not check this condition. So owner can set donId is empty.
Vulnerability Details
In the constructor have check condition require(_donId != "", "DON ID must be set");
constructor(
address router,
bytes32 _donId
) FunctionsClient(router) ConfirmedOwner(msg.sender) {
require(_donId != "", "DON ID must be set");
donId = _donId;
}
/**
* @notice Set the DON ID
* @param newDonId New DON ID
*/
function setDonId(bytes32 newDonId) external onlyOwner {
donId = newDonId;
}
in the setDonId function don't check newDonId != "" so owner can set donId is empty.
Impact
Affecting the logic of the contract
Tools Used
Manual
Recommendations
Add check condition require(_donId != "", "DON ID must be set");
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.