Root + Impact

Description

The requestMintWeatherNFT function does not validate whether the _heartbeat value is above a reasonable threshold. Without this check, a user can set _heartbeat to 0 or an extremely low value, which can result in:

• Unintended or rapid keeper executions

• Excessive function calls or oracle triggers

• Increased gas consumption and LINK depletion

• Congestion of the keeper or automation logic

This can degrade the reliability and cost-efficiency of the system.

Risk

Likelihood:

A user calling this function with _heartbeat = 0 will immediately cause the system to assume that the next keeper job is due, resulting in:

• Immediate triggering of registered automation (if integrated)

• Continuous triggering if no minimum enforcement exists

• This behavior can be exploited repeatedly since the function is public and the check is missing.

Impact:

• Wasted LINK gas

• Network congestion

Proof of Concept

Recommended Mitigation

Add a constant in the contract to define the minimum allowed heartbeat interval. Then, in the requestMintWeatherNFT function, validate that the _heartbeat provided by the user meets or exceeds this threshold.