Weather Witness

Summary

The WeatherNft::performUpkeep function allows any external address to call it with a valid tokenId, triggering a new Chainlink Functions request and consuming LINK from the Automation subscription balance. There are no access controls or heartbeat checks to restrict how frequently this can be called. An attacker can repeatedly call performUpkeep to rapidly drain all LINK from the subscription, causing denial of service for legitimate users and disabling the NFT's automated weather updates.

Vulnerability Details

Issues Identified

1. Unrestricted LINK Drain

   • Anyone can call performUpkeep with the tokenId of an NFT, regardless of whether the heartbeat interval has passed or whether the caller is a trusted automation agent.

   • Each call triggers a Chainlink Functions request and consumes LINK from the Automation subscription balance.

   • Repeated or automated calls will quickly exhaust the LINK balance, breaking automated updates for all NFTs in the project.

Risk

Likelihood:

• Any attacker or bot can repeatedly call performUpkeep with the same tokenId, as often as they want.

• This attack does not require any special privileges or timing, making it trivial to exploit on a large scale.

Impact:

• All LINK in the project's Chainlink Automation subscription can be drained, incurring significant financial loss.

• Legitimate users lose automated weather updates for their NFTs, and the service is effectively disabled until more LINK is deposited.

Proof of Concept (PoC)

This PoC demonstrates an attacker can drain LINK by repeatedly calling performUpkeep with the same tokenId, even if the heartbeat interval has not elapsed.

PoC Explanation

1. A legitimate user mints a Weather NFT, registering for automated weather updates. This process funds the Chainlink Automation subscription with LINK.

2. The attacker waits for the NFT to be minted and retrieves the tokenId.

3. The attacker then repeatedly calls performUpkeep with the same tokenId, simulating hundreds of rapid weather update requests.

4. Each call to performUpkeep triggers a Chainlink Functions request and consumes LINK from the project's Automation subscription balance.

5. Because there are no heartbeat checks or access controls, the attacker is able to continuously drain the LINK balance, eventually exhausting all funds allocated for automation.

6. Once the LINK balance is depleted, legitimate users lose the ability to receive automated weather updates for their NFTs, and the automation feature is effectively disabled until the subscription is refilled.

Tools Used

• Manual Review

• Foundry Unit Testing

Recommendations

• Enforce a Heartbeat Check
  Require that performUpkeep can only be executed if the heartbeat interval has elapsed since the last successful weather update. This prevents repeated or premature calls from consuming LINK unnecessarily.

  require(

  block.timestamp >= info.lastFulfilledAt + info.heartbeat,

  "Not time for upkeep"

  );

• Refine Access Controls for Automated and Manual Updates
  Differentiate between NFTs registered with Chainlink Automation (having a nonzero upkeepId) and those without.

  • For automated updates (info.upkeepId != 0), allow only the Keeper Registry contract to call.

  • For manual updates (info.upkeepId == 0), allow only the NFT owner to call.

  function performUpkeep(bytes calldata performData)

  external

  override

  {

  uint256 _tokenId = abi.decode(performData, (uint256));

  WeatherNftInfo storage info = s_weatherNftInfo[_tokenId];

  ​

  // Heartbeat check

  require(

  block.timestamp >= info.lastFulfilledAt + info.heartbeat,

  "Not time for upkeep"

  );

  ​

  if (info.upkeepId != 0) {

  // Automated upkeep: only keeper registry may call

  require(msg.sender == s_keeperRegistry, "Only keeper registry");

  } else {

  // Manual update: only NFT owner may call

  require(msg.sender == ownerOf(_tokenId), "Only NFT owner");

  }

  ​

  // ... proceed with sending Chainlink Functions request ...

  }