Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Lack of Validation for source in _sendFunctionsWeatherFetchRequest Leads to Potentially Empty JavaScript Source Code

igdbaxe

Root + Impact

Description

  • Normal Behavior: The contract should only initiate Chainlink Functions requests when valid JavaScript source code is provided to fetch weather data.

  • Issue: The _sendFunctionsWeatherFetchRequest function fails to verify if s_functionsConfig.source is empty before initializing the request, despite Chainlink's documentation requiring non-empty source code.

function _sendFunctionsWeatherFetchRequest(string memory _pincode, string memory _isoCode) internal returns (bytes32 _reqId) {
FunctionsRequest.Request memory req;
@> req.initializeRequestForInlineJavaScript(s_functionsConfig.source); // No check for empty source
// ...
}

Risk

Likelihood:

  1. Whenever s_functionsConfig.source is empty due to a lack of validation in updateSource, this issue will manifest in functions like requestMintWeatherNFT

  2. As no runtime checks enforce the non-emptiness of source, inadvertent or malicious updates can lead to failures.

Impact:

  1. Failed NFT Minting: Users pay mint fees but receive NFTs with stale/default weather data.

  2. Wasted Gas/LINK: Requests will revert or fail silently, consuming resources without completing the workflow.

Recommended Mitigation

function _sendFunctionsWeatherFetchRequest(string memory _pincode, string memory _isoCode) internal returns (bytes32 _reqId) {
+ require(bytes(s_functionsConfig.source).length > 0, "Empty JS source");
FunctionsRequest.Request memory req;
req.initializeRequestForInlineJavaScript(s_functionsConfig.source);
// ...
}
​
// Additional defense in updateSource()
function updateSource(string memory newSource) external onlyOwner {
+ require(bytes(newSource).length > 0, "Source cannot be empty");
s_functionsConfig.source = newSource;
}
Updates

Appeal created

bube Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.