Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

## WeatherNft.sol ## [ Input validation for _initLinkDeposit ]

hawks

Root + Impact

Description

The requestMintWeatherNFT function allows users to mint a weather NFT by sending the exact ETH mint price. Optionally, the user can register a Chainlink Keeper by specifying _registerKeeper as true and funding the upkeep with _initLinkDeposit LINK.

However, the contract does not validate the _initLinkDeposit parameter. As a result, a user can pass a 0 deposit amount.

function requestMintWeatherNFT(
string memory _pincode,
string memory _isoCode,
bool _registerKeeper,
uint256 _heartbeat,
@> uint256 _initLinkDeposit
) external payable returns (bytes32 _reqId) {
require(
msg.value == s_currentMintPrice,
WeatherNft__InvalidAmountSent()
);
s_currentMintPrice += s_stepIncreasePerMint;
​
if (_registerKeeper) {
IERC20(s_link).safeTransferFrom(
msg.sender,
address(this),
_initLinkDeposit
);
}
​
_reqId = _sendFunctionsWeatherFetchRequest(_pincode, _isoCode);
emit WeatherNFTMintRequestSent(msg.sender, _pincode, _isoCode, _reqId);
​
s_funcReqIdToUserMintReq[_reqId] = UserMintRequest({
user: msg.sender,
pincode: _pincode,
isoCode: _isoCode,
registerKeeper: _registerKeeper,
heartbeat: _heartbeat,
initLinkDeposit: _initLinkDeposit
});
}

Risk

Likelihood:

  • The issue occurs every time a user attempts to mint an NFT with _registerKeeper = true but specifies 0 as the _initLinkDeposit.

  • Users or frontend developers unaware of the required LINK deposit value may unintentionally pass 0 or insufficient amounts, leading to failed automation setup.

Impact:

  • The user pays full ETH minting price under the assumption that automation will be configured, but their NFT will not have an active upkeep.

  • LINK tokens could be transferred with no meaningful impact or silently fail, potentially misleading the user and increasing support costs or misbehavior in app UX

Proof of Concept

weatherNft.requestMintWeatherNFT{value: 0.01 ether}(
"123456",
"IN",
true, // Attempt to register keeper
3600, // 1 hour heartbeat
0 // No LINK deposit
);
​
// Expected: keeper registered
// Actual: LINK transfer has no effect, upkeep likely fails silently

Recommended Mitigation

- if (_registerKeeper) {
- IERC20(s_link).safeTransferFrom(
- msg.sender,
- address(this),
- _initLinkDeposit
- );
- }
​
​
​
+ if (_registerKeeper) {
+ require(_initLinkDeposit > 0, "Invalid LINK deposit");
+ IERC20(s_link).safeTransferFrom(
+ msg.sender,
+ address(this),
+ _initLinkDeposit
+ );
+ }
Updates

Appeal created

bube Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] The LINK deposit is not checked

This is informational/invalid. If the LINK deposit is not enough, the function `registerUpkeep` will revert and it is responsibility of the user to provide the correct amount of `_initLinkDeposit`, if the user wants automated weather updates.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.