Submission Details
Severity:
Lack of Withdraw Mechanism for ETH/LINK Funds in `WeatherNft.sol `protocol
Root + Impact
Description
-
The WeatherNft.sol contract accepts both ETH (for NFT minting) and LINK (for Chainlink Automation) but provides no function to withdraw these funds. This affects:
-
ETH from requestMintWeatherNFT (stored as s_currentMintPrice)
-
LINK from keeper registrations (stored in contract balance)
-
// Root cause in the codebase with @> marks to highlight the relevant section
Impact:
-
Funds will inevitably accumulate
Permanent loss of all ETH/LINK revenue and user deposits
Proof of Concept
Recommended Mitigation
add the following function in WeatherNft.sol contract
+ function withdrawETH(address payable to) external onlyOwner {
+ (bool success,) = to.call{value: address(this).balance}("");
+ require(success, "Transfer failed");
// add some event
+}
Updates
Appeal created
bube 5 months ago
Submission Judgement Published Assigned finding tags:
Lack of `withdraw` function
The contract collects funds for minting a WeatherNFT, but there is no function that allows the owner to withdraw these funds.
Rewards breakdown
nSLOC
236This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.