Submission Details
Severity:
All Eth is locked in the contract
Description
Contract WeatherNft receives Eth when a user mints NFT using function WeatherNft::requestMintWeatherNFT:
function requestMintWeatherNFT(
string memory _pincode,
string memory _isoCode,
bool _registerKeeper,
uint256 _heartbeat,
uint256 _initLinkDeposit
) external payable returns (bytes32 _reqId) {
require(
msg.value == s_currentMintPrice,
WeatherNft__InvalidAmountSent()
);
...
}
However, there is no functions that withdraw Eth. That means that all Eth sent to the contract are locked in the contract.
Risk
Likelihood: High
Impact: High
All Eth paid to mint NFTs is locked in the contract.
Recommended Mitigation
Add a function to withdraw Eth:
function withdraw() external onlyOwner {
uint256 balance = address(this).balance;
require(balance > 0, "No ETH available to withdraw");
payable(owner()).transfer(balance);
}
Updates
Appeal created
bube about 1 month ago
Submission Judgement Published Assigned finding tags:
Lack of `withdraw` function
The contract collects funds for minting a WeatherNFT, but there is no function that allows the owner to withdraw these funds.
Rewards breakdown
nSLOC
236This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.