Root + Impact

Description

• In the WeatherNft contract, several inherited state variables from WeatherNftStore (e.g. s_functionsConfig, s_link, s_keeperRegistry) are initialized via constructor parameters, allowing flexible and transparent deployment configuration.

  However, s_tokenCounter, also declared in WeatherNftStore, is hardcoded directly in the constructor body instead of being set via a constructor argument. This breaks the consistency of initialization and may lead to confusion or limited flexibility in future updates.

Risk

Likelihood:

• Reason 1 // This will occur every time the contract is deployed, since s_tokenCounter is not configurable.

• Reason 2 // Developers modifying the deployment logic or porting the contract to another project may overlook that s_tokenCounter is hardcoded and not part of the standard configuration.

Impact:

• Impact 1 // Limits the flexibility to start token IDs from custom values like 0, 1000, etc.

• Impact 2 // Reduces consistency across state variable initialization, which could impact maintainability or clarity during audits or upgrades.

Proof of Concept

Recommended Mitigation