Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Oracle Failure Can Permanently Burn Mint Fee Without Refund

mihailvichev00

Root + Impact

Description

Normal Behavior:
When a user calls requestMintWeatherNFT(...), they pay the current mint price (e.g., 0.01 ETH) to the contract. A Chainlink Functions request is triggered to fetch weather data. After the oracle responds, the user must finalize minting via fulfillMintRequest().
​
Problem:
If the Chainlink request fails — for example, due to a timeout, bad API key, or off-chain JavaScript error — the contract still:
​
Increments s_currentMintPrice
​
Records the failed request
​
Keeps the user’s ETH
​
Does not mint an NFT
​
Does not refund or allow retries
​
There is no fallback mechanism, no refund, and no user recourse.

Risk

Likelihood:

  • Reason 1: Oracle responses can fail in decentralized networks due to API rate limits, expired keys, malformed responses, or DON-level errors.

  • Reason 2: Users can unknowingly mint at high prices only to have their mint silently dropped, without any error feedback on-chain or refund.

Impact:

  • Impact 1: The user permanently loses ETH without receiving an NFT.

  • Impact 2: Repeated oracle failures can financially and reputationally damage the protocol, especially as s_currentMintPrice rises.

Proof of Concept

// Simulate a failed Chainlink response
s_funcReqIdToMintFunctionReqResponse[requestId] = MintFunctionReqResponse({
response: "", // empty response
err: abi.encode("Off-chain script failed")
});
​
// Anyone calls fulfillMintRequest
weatherNft.fulfillMintRequest(requestId);
​
// The function returns silently (no NFT minted, no refund)
​
//User loses payment:
​
require(msg.value == s_currentMintPrice); // Paid upfront
s_currentMintPrice += s_stepIncreasePerMint; // Already incremented
​
​

Recommended Mitigation

- remove this code
emit MintRequestFailed(requestId, msg.sender, reason);
​
Updates

Appeal created

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Lost fee in case of Oracle failure

If Oracle fails, the `fulfillMintRequest` function will not return the payed fee for the token to the user.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!