Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

fulfillMintRequest() will always revert or return without execution

0xziin

Root + Impact

fulfillMintRequest() will always revert or return without execution

Description

// This function will never be executed passed the 10th line, it will always revert or return
function fulfillMintRequest(bytes32 requestId) external {
bytes memory response = s_funcReqIdToMintFunctionReqResponse[requestId].response;
bytes memory err = s_funcReqIdToMintFunctionReqResponse[requestId].err;
require(response.length > 0 || err.length > 0, WeatherNft__Unauthorized()); //<@
​
if (response.length == 0 || err.length > 0) { //<@
return;
}
...

Risk

Likelihood: High

  • Every single time the function is called

Impact: High

  • Minting of the weather NFT becomes impossible

Proof of Concept

Let try each possible case and see what happens.

Case 1 : There is a response (error or not) => response.length > 0

require(response.length > 0 || err.length > 0, WeatherNft__Unauthorized()); // It will revert with WeatherNft_Unauthorized()
// because response.length > 0

=> The function shouldn't revert if there is a response but no error. Here it reverts. It's an abnormal behavior.

Case 2 : There is an error => err.length > 0

require(response.length > 0 || err.length > 0, WeatherNft__Unauthorized()); // It will revert with WeatherNft_Unauthorized()
// because err.length > 0

=> Normal behavior, it should revert.

Case 3 : There is no response (error or not) => response.length == 0

if (response.length == 0 || err.length > 0) { // It will stop the execution of the function here
return; // because response.length == 0
}

=> Normal behavior, it should return.


## Recommended Mitigation

Change the require() and if statement to reflect the 2 possibilities for not minting the NFT :
- There is an error => it should revert
- There is no response => it should return

function fulfillMintRequest(bytes32 requestId) external {
bytes memory response = s_funcReqIdToMintFunctionReqResponse[requestId].response;
bytes memory err = s_funcReqIdToMintFunctionReqResponse[requestId].err;
- require(response.length > 0 || err.length > 0, WeatherNft__Unauthorized());
+ require(err.length > 0, WeatherNft__Unauthorized());
​
- if (response.length == 0 || err.length > 0) {
+ if (response.length == 0) {
return;
}
...
Updates

Appeal created

bube Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.