Weather Witness

First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Submission Details
Severity: high
Valid

Oracle Failure Can Permanently Burn Mint Fee Without Refund

Root + Impact

Description

Normal Behavior:
When a user calls requestMintWeatherNFT(...), they pay the current mint price (e.g., 0.01 ETH) to the contract. A Chainlink Functions request is triggered to fetch weather data. After the oracle responds, the user must finalize minting via fulfillMintRequest().
Problem:
If the Chainlink request fails — for example, due to a timeout, bad API key, or off-chain JavaScript errorthe contract still:
Increments s_currentMintPrice
Records the failed request
Keeps the user’s ETH
Does not mint an NFT
Does not refund or allow retries
There is no fallback mechanism, no refund, and no user recourse.

Risk

Likelihood:

  • Reason 1: Oracle responses can fail in decentralized networks due to API rate limits, expired keys, malformed responses, or DON-level errors.

  • Reason 2: Users can unknowingly mint at high prices only to have their mint silently dropped, without any error feedback on-chain or refund.

Impact:

  • Impact 1: The user permanently loses ETH without receiving an NFT.

  • Impact 2: Repeated oracle failures can financially and reputationally damage the protocol, especially as s_currentMintPrice rises.

Proof of Concept

// Simulate a failed Chainlink response
s_funcReqIdToMintFunctionReqResponse[requestId] = MintFunctionReqResponse({
response: "", // empty response
err: abi.encode("Off-chain script failed")
});
// Anyone calls fulfillMintRequest
weatherNft.fulfillMintRequest(requestId);
// The function returns silently (no NFT minted, no refund)
//User loses payment:
require(msg.value == s_currentMintPrice); // Paid upfront
s_currentMintPrice += s_stepIncreasePerMint; // Already incremented

Recommended Mitigation

- remove this code
emit MintRequestFailed(requestId, msg.sender, reason);
Updates

Appeal created

bube Lead Judge 23 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Lost fee in case of Oracle failure

If Oracle fails, the `fulfillMintRequest` function will not return the payed fee for the token to the user.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.