Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Function WeatherNft::performUpkeep lacks of access control leading to potential LINK loss

al88nsk

Description

Function WeatherNft::performUpkeep calls function `` that initiates sending request to Chainlink:

function performUpkeep(bytes calldata performData) external override { // @audit no permissions check
uint256 _tokenId = abi.decode(performData, (uint256));
uint256 upkeepId = s_weatherNftInfo[_tokenId].upkeepId;
​
s_weatherNftInfo[_tokenId].lastFulfilledAt = block.timestamp;
​
// make functions request
string memory pincode = s_weatherNftInfo[_tokenId].pincode;
string memory isoCode = s_weatherNftInfo[_tokenId].isoCode;
​
bytes32 _reqId = _sendFunctionsWeatherFetchRequest(pincode, isoCode);
s_funcReqIdToTokenIdUpdate[_reqId] = _tokenId;
​
emit NftWeatherUpdateRequestSend(_tokenId, _reqId, upkeepId);
}

When a request to Chainlink is fulfilled, some LINK tokens are transferred from the contract owner subscription as a fee. Since the function does not have any access control, any user can call it as many times as they want, thus wasting LINK tokens from the contract owner subscription.

Risk

Likelihood: High

Any user can perform upkeep for any token at any time.

Impact: Medium

LINK from the contract owner subscription is spent every time a request is sent and fulfilled. On the other hand, the attacker pays for gas for every call.

Recommended Mitigation

Add validation that performUpkeep can be called only by keeper registry.

Updates

Appeal created

bube Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Anyone can call `performUpkeep` function

The `performUpkeep` function should be called by the Chainlink keepers or owners of the NFT. But there is no access control and anyone can call the function. This leads to malicious consumption of the user's LINK deposit.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.