Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Mint price increases even when request fails in `requestMintWeatherNFT`

red_jamie

Root + Impact

Description

  • The requestMintWeatherNFT function increases s_currentMintPrice by s_stepIncreasePerMint immediately after the require(msg.value == s_currentMintPrice) check. However, the actual mint request may still fail later (e.g., due to incorrect parameters or failed LINK transfer), meaning the user won't receive an NFT but the price still increases for the next user.

  • This leads to inconsistent pricing and allows accidental or malicious calls to cause artificial mint price inflation, harming fairness and usability.


function requestMintWeatherNFT(
string memory _pincode,
string memory _isoCode,
bool _registerKeeper,
uint256 _heartbeat,
uint256 _initLinkDeposit
) external payable returns (bytes32 _reqId) {
require(
msg.value == s_currentMintPrice,
WeatherNft__InvalidAmountSent()
);
@> s_currentMintPrice += s_stepIncreasePerMint;
​
if (_registerKeeper) {
IERC20(s_link).safeTransferFrom(
msg.sender,
address(this),
_initLinkDeposit
);
}
​
_reqId = _sendFunctionsWeatherFetchRequest(_pincode, _isoCode);
​
emit WeatherNFTMintRequestSent(msg.sender, _pincode, _isoCode, _reqId);
​
s_funcReqIdToUserMintReq[_reqId] = UserMintRequest({
user: msg.sender,
pincode: _pincode,
isoCode: _isoCode,
registerKeeper: _registerKeeper,
heartbeat: _heartbeat,
initLinkDeposit: _initLinkDeposit
});
}
​

Risk

Likelihood:

  • Easy to trigger by sending incorrect inputs.

Impact:

  • Can cause unjustified price increases, user frustration, and potential DoS (e.g., pricing out legitimate users).

Recommended Mitigation

  • Add the price increase at fulfillMintRequest after validation

function fulfillMintRequest(bytes32 requestId) external {
bytes memory response = s_funcReqIdToMintFunctionReqResponse[requestId].response;
bytes memory err = s_funcReqIdToMintFunctionReqResponse[requestId].err;
​
require(response.length > 0 || err.length > 0, WeatherNft__Unauthorized());
​
if (response.length == 0 || err.length > 0) {
return;
}
​
+ s_currentMintPrice += s_stepIncreasePerMint;
​
. . .
​
Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

The price of the token is increased before the token is minted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.