Root + Impact
Description
-
_mint() function in fulfillMintRequest() should mint a Weather NFT to the user's address
-
The current implementation mints a Weather NFT to msg.sender, which here in fulfillMintRequest() is Chainlink Functions Oracle
function fulfillMintRequest(bytes32 requestId) external {
bytes memory response = s_funcReqIdToMintFunctionReqResponse[requestId]
.response;
bytes memory err = s_funcReqIdToMintFunctionReqResponse[requestId].err;
require(
response.length > 0 || err.length > 0,
WeatherNft__Unauthorized()
);
if (response.length == 0 || err.length > 0) {
return;
}
UserMintRequest memory _userMintRequest = s_funcReqIdToUserMintReq[
requestId
];
uint8 weather = abi.decode(response, (uint8));
uint256 tokenId = s_tokenCounter;
s_tokenCounter++;
emit WeatherNFTMinted(requestId, msg.sender, Weather(weather));
_mint(msg.sender, tokenId);
s_tokenIdToWeather[tokenId] = Weather(weather);
}
Risk
Likelihood:
-
Reason 1 This happens everytime a request to mint a Weather NFT is made, by calling requestMintWeatherNFT
-
Reason 2 In response to the mint request Chainlink Functions calls fulfillMintRequest, which contains the _mint(msg.sender, tokenId) function, with incorrect NFT recipient
Impact:
Proof of Concept
Recommended Mitigation
Send NFT to _userMintRequest.user, instead of sending it to msg.sender.
Update event WeatherNFTMinted.
function fulfillMintRequest(bytes32 requestId) external {
bytes memory response = s_funcReqIdToMintFunctionReqResponse[requestId]
.response;
bytes memory err = s_funcReqIdToMintFunctionReqResponse[requestId].err;
require(
response.length > 0 || err.length > 0,
WeatherNft__Unauthorized()
);
if (response.length == 0 || err.length > 0) {
return;
}
UserMintRequest memory _userMintRequest = s_funcReqIdToUserMintReq[
requestId
];
uint8 weather = abi.decode(response, (uint8));
uint256 tokenId = s_tokenCounter;
s_tokenCounter++;
emit WeatherNFTMinted(requestId, _userMintRequest.user, Weather(weather)); + change
_mint(_userMintRequest.user, tokenId); + change
// and not to user; Should use _userMintRequest.user
s_tokenIdToWeather[tokenId] = Weather(weather);
// ...Rest of code
}
