Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

No inputs validation - pincode and isoCode in GeatWeather.js

perun84

Root + Impact

Description

  • The GetWeather.js script used by Chainlink Functions expects a valid combination of pincode and isoCode to fetch geolocation data from the OpenWeatherMap API.

  • If a user provides an invalid or non-existent combination, the API call fails, causing the script to throw an error. As a result, the oracle fulfillment fails, and the user cannot mint the NFT, even though they paid the minting fee.

const geoCodingRequest = Functions.makeHttpRequest({
url: "https://api.openweathermap.org/geo/1.0/zip",
method: "GET",
params: { zip: `${args[0]},${args[1]}`, appid: secrets.apiKey }
})
​
const geoCodingResponse = await geoCodingRequest;
​
if (geoCodingResponse.error) throw Error("Request failed, try checking the params provided")
.
.
.
.
.
if (weatherResponse.error) throw Error("Request failed, try checking the params provided")

Risk

Likelihood:

  • This will occur whenever a user enters an invalid or unsupported pincode/isoCode combination.

  • Users may make mistakes or typos, or may attempt to mint for locations not supported by the API.

Impact:

  • Users lose their minting fee and receive no NFT.

Proof of Concept

A user submits an invalid pincode/isoCode, causing GetWeather.js to throw an error and preventing NFT minting even user paid for it.

// User calls mint with an invalid pincode/isoCode
weatherNft.requestMintWeatherNFT("000000", "ZZ", false, 12 hours, 0);
​
// Chainlink Functions script fails to fetch geolocation, throws error
​
// User cannot call fulfillMintRequest successfully, NFT is not minted

Recommended Mitigation

  • Add input validation in the smart contract to check for obviously invalid pincodes or isoCodes before sending the request.

  • In GetWeather.js, handle API errors gracefully and return a specific error code or message that can be surfaced to the user.

  • Refunding the minting fee or allowing the user to retry with corrected input if the oracle request fails.

-if (geoCodingResponse.error) throw Error("Request failed, try checking the params provided")
+if (geoCodingResponse.error || !geoCodingResponse.data || !geoCodingResponse.data.lat || !geoCodingResponse.data.lon) {
+ return Functions.encodeUint256(999);
+}
​
const weatherResponse = await weatherRequest;
-if (weatherResponse.error) throw Error("Request failed, try checking the params provided")
+if (weatherResponse.error || !weatherResponse.data || !weatherResponse.data.weather) {
+ return Functions.encodeUint256(999);
+}
Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] Lack of input validation in `requestMintWeatherNFT`

This is informational. It is user's responsibility to provide correct input arguments. If the user provides incorrect arguments, it will lead to incorrect results, lost funds or failed transaction.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.