Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The performUpkeep function lacks permission verification.

hyer

Root + Impact

  • Any user can call it.

  • An attacker could repeatedly forge `performData` and invoke the function.

  • Malicious actors are flooding the blockchain with forged update requests, overwriting the s_funcReqIdToTokenIdUpdate mapping and obfuscating the fulfillment path.

Description

The performUpkeep(bytes calldata performData) function in the smart contract is designed to be triggered by the Chainlink Automation (Keeper) system when predefined conditions are met, aiming to update the on-chain data of a weather NFT. However, this function lacks any permission checks on the caller, allowing any external account (EOA) or contract to invoke it at will.
This violates the statement "When it's time for an update, the keeper calls performUpkeep."

https://github.com/CodeHawks-Contests/2025-05-weather-witness?tab=readme-ov-file#automating-weather-updates

function performUpkeep(bytes calldata performData) external override {
...
}

Recommended Mitigation

Check if the caller is the registered Chainlink Keeper

​
function performUpkeep(bytes calldata performData) external override {
if (msg.sender != automationRegistryAddress) {
revert("Only automation registry allowed");
}
...
}
Updates

Appeal created

bube Lead Judge 7 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Anyone can call `performUpkeep` function

The `performUpkeep` function should be called by the Chainlink keepers or owners of the NFT. But there is no access control and anyone can call the function. This leads to malicious consumption of the user's LINK deposit.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.