Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

Missing validation for _initLinkDeposit during Keeper registration

vakoff20

Root + Impact

Description

When a user opts into registering a Chainlink Keeper during NFT minting, the contract attempts to pull LINK from the user's wallet using _initLinkDeposit via safeTransferFrom. However, there are no checks to ensure that:

  • _initLinkDeposit is greater than zero

  • The user has approved enough LINK beforehand

As a result, the contract could either silently accept a 0 LINK transfer or revert due to missing approval, with no explanation or fallback. This may cause the user’s Keeper setup to silently fail or the entire transaction to revert unexpectedly.

if (_registerKeeper) {
IERC20(s_link).safeTransferFrom(
msg.sender,
address(this),
@// _initLinkDeposit
);
}

Risk

Likelihood:

  • This occurs when users enable _registerKeeper and mistakenly enter 0 or forget to call approve() for LINK beforehand.

  • There is no built-in feedback or validation to prevent this, so confusion and misuse are likely during real-world interactions or frontend integration.

Impact:

  • Failed Keeper setup leads to weather NFTs not updating automatically.

  • Users may wrongly believe their NFT is registered with automation, but it's not — causing loss of expected service despite paying ETH.

Proof of Concept

// User tries to mint with Keeper enabled but gives 0 LINK
requestMintWeatherNFT("10001", "US", true, 86400, 0);
​
// Result:
// - Transaction does NOT revert
// - 0 LINK is transferred
// - No Keeper is meaningfully set up
// - User gets no error or refund

Recommended Mitigation

- if (_registerKeeper) {
- IERC20(s_link).safeTransferFrom(
- msg.sender,
- address(this),
- _initLinkDeposit
- );
- }
​
+ if (_registerKeeper) {
+ require(_initLinkDeposit > 0, "Invalid LINK deposit");
+ IERC20(s_link).safeTransferFrom(
+ msg.sender,
+ address(this),
+ _initLinkDeposit
+ );
+ }
Updates

Appeal created

bube Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] The LINK deposit is not checked

This is informational/invalid. If the LINK deposit is not enough, the function `registerUpkeep` will revert and it is responsibility of the user to provide the correct amount of `_initLinkDeposit`, if the user wants automated weather updates.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.