Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The **NFT Hijacking Vulnerability** caused by the lack of permission verification in the `fulfillMintRequest` function.

hyer

Root + Impact

Description

In the contract, the fulfillMintRequest(bytes32 requestId, bytes memory response, bytes memory err) function does not verify whether the caller is the user corresponding to the request ID (requestId). This allows anyone to use another person's requestId to mint NFTs, thereby transferring ownership of the NFTs that should belong to others to themselves.

function fulfillMintRequest(bytes32 requestId, bytes memory response, bytes memory err) public {
// No verification of the binding relationship between msg.sender and requestId
// Mint directly based on msg.sender
_mint(msg.sender, tokenId);
}

Risk

Impact:

The NFT is minted to the wrong address.

Proof of Concept

  • User A initiates a request via requestMintWeatherNFT().

  • The chain triggers an event or stores the requestId.

  • Attacker B monitors the chain events (such as WeatherRequestSent) and obtains this requestId.

  • B forges a call to fulfillMintRequest(requestId, ...).

  • The contract mints the NFT, which was supposed to be minted to A, to B instead.

Recommended Mitigation

Add permission verification logic in fulfillMintRequest to ensure that only the original requester can complete the minting.

​
function fulfillMintRequest(bytes32 requestId, bytes memory response, bytes memory err) public {
MintRequest memory req = s_funcReqIdToUserMintReq[requestId];
// Permission check: Only the original requester is allowed to call
require(msg.sender == req.user, "Not request owner");
.....
_mint(msg.sender, tokenId);
}
​
Updates

Appeal created

bube Lead Judge 12 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of ownership check in `fulfillMintRequest` function

There is no check to ensure that the caller of the `fulfillMintRequest` function is actually the owner of the `requestId`. This allows a malicious user to receive a NFT that is payed from someone else.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.