Submission Details
Impact:
Likelihood:
[EVMNINJA-WW06] Missing Token Existence Check in `performUpkeep()`
Root + Impact
Description
The performUpkeep() function does not check if the token exists before attempting to update its weather data. AlthoughcheckUpkeep() does this check, an attacker could call performUpkeep directly with an invalid token ID.
function performUpkeep(bytes calldata performData) external override {
uint256 _tokenId = abi.decode(performData, (uint256));
// No check if token exists
// ...
}```
## Risk
**Likelihood**:
Low Likelihood
**Impact**:
Medium impact.
## Proof of Concept
```solidity
Recommended Mitigation
Add a token existence check at the beginning of the performUpkeep function:
function performUpkeep(bytes calldata performData) external override {
uint256 _tokenId = abi.decode(performData, (uint256));
// Check if token exists
require(_ownerOf(_tokenId) != address(0), "Token does not exist");
uint256 upkeepId = s_weatherNftInfo[_tokenId].upkeepId;
// ... rest of the function
}
Rewards breakdown
nSLOC
236This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.