Weather Witness

Summary

The WeatherNft::requestMintWeatherNFT function requires users to pay an ETH minting fee (msg.value == s_currentMintPrice) to mint a Weather NFT. However, the contract does not implement any mechanism to withdraw, use, or manage the received ETH after it is sent. As a result, all ETH collected by the contract through minting is permanently locked within the contract, with no way for the owner or users to retrieve or utilize these funds.

Vulnerability Details

Issue Identified

• The contract collects ETH from users during the NFT minting process via msg.value.

• No function exists for the owner or anyone else to withdraw, refund, or otherwise utilize these ETH funds.

• The ETH remains permanently locked inside the contract balance.

• Users may reasonably expect that these funds are used for project operations, artist payments, or can be withdrawn by the contract owner, but none of these actions are possible in the current implementation.

Risk

Likelihood:

• This issue is present by default as a result of the current contract logic.

• Any user minting a Weather NFT will trigger this behavior.

Impact:

• Permanent loss of user funds paid for minting NFTs.

• Inability for the protocol owner to access or use the accumulated ETH for further project development, rewards, or expenses.

• Negative user experience and potential reputational damage due to perceived or actual fund mismanagement.

Tools Used

• Manual Review

• Solidity IDE / Contract Inspection

Recommendations

Implement ETH Withdrawal Mechanism

Add a secure withdraw function, restricted to the contract owner, to allow withdrawal of accumulated ETH:

This update ensures that any ETH paid for minting can be properly managed and withdrawn by the contract owner, eliminating the risk of permanently locked funds.