Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Missing `addSecretsReference` integration causes secrets to be undefined in `GetWeather.js`

red_jamie

Root + Impact

Description

  • In the Chainlink Functions source, the script makes an HTTP request using:

const geoCodingRequest = Functions.makeHttpRequest({
url: "http://api.openweathermap.org/geo/1.0/zip",
method: "GET",
@> params: { zip: `${args[0]},${args[1]}`, appid: secrets.apiKey }
})

  • However, the secrets object will be called undefined due to the missing call to addSecretsReference in the request configuration. Without this, the script cannot access secrets.apiKey, resulting in runtime failure during off-chain computation. The entire oracle request will revert or return an error.

Risk

Likelihood:

This is a misconfiguration that will always trigger on execution.

Impact:

The core functionality of the Chainlink Functions-based weather data retrieval is broken, rendering minting or automation logic non-functional.

Proof of Concept

This issue was confirmed during testing on a testnet, where the computation failed with an error: `Request failed, try checking the params provided.` After investigation, apiKey was undefined

Recommended Mitigation

function _sendFunctionsWeatherFetchRequest(string memory _pincode, string memory _isoCode)
internal
returns (bytes32 _reqId)
{
FunctionsRequest.Request memory req;
req.initializeRequestForInlineJavaScript(s_functionsConfig.source);
string[] memory _args = new string[](2);
_args[0] = _pincode;
_args[1] = _isoCode;
​
req.setArgs(_args);
+ req.addSecretsReference(s_functionsConfig.encryptedSecretsURL);
​
_reqId =
_sendRequest(req.encodeCBOR(), s_functionsConfig.subId, s_functionsConfig.gasLimit, s_functionsConfig.donId);
}
Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.