Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

_requestId can be replayed f

0xstacker

Description

  • fulfillMintRequest allows users to mint multiple NFTs using the same requestId.

  • This could potentially drain the $LINK tokens accumulated by the contract from users who are looking to register automatic upkeep if an automatic upkeep was registered to the requestId being replayed by the attacker.

  • The check set to prevent this in the contract does not work as intended because response and err were never reset after the mint is fulfilled.

function fulfillMintRequest(bytes32 requestId) external {
bytes memory response = s_funcReqIdToMintFunctionReqResponse[requestId].response;
bytes memory err = s_funcReqIdToMintFunctionReqResponse[requestId].err;
// response and err were never reset in this function which renders this check irrelevant
@> require(response.length > 0 || err.length > 0, WeatherNft__Unauthorized());
if (response.length == 0 || err.length > 0) {
return;
}
// ...
}
​

Impact:

  • Unpaid mints

  • Unauthorized use of $LINK tokens supplied to the contract.

Recommended Mitigation

Reset response and err for each mint request as it gets fulfilled

function fulfillMintRequest(bytes32 requestId) external {
bytes memory response = s_funcReqIdToMintFunctionReqResponse[requestId].response;
bytes memory err = s_funcReqIdToMintFunctionReqResponse[requestId].err;
​
require(response.length > 0 || err.length > 0, WeatherNft__Unauthorized());
+ s_funcReqIdToMintFunctionReqResponse[requestId].response = "";
+ s_funcReqIdToMintFunctionReqResponse[requestId].err = "";
if (response.length == 0 || err.length > 0) {
return;
}
​
...
}
Updates

Appeal created

bube Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Multiple tokens for one `requestId`

The `WeatherNFT::fulfillMintRequest` allows a malicious user to call multiple times the function with the same `requestId`.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.