Submission Details
Severity:
Unprotected 'performUpkeep' (Missing Registry Check + LINK Drain).
Description: 'performUpkeep' is 'external override' with no 'require(msg.sender == keeperRegistry) guard'.
Impact: Any EOA can call 'performUpkeep', triggering new weather requests and draining LINK from the contract or user’s deposit.
Proof of Concept:
// Simple repro: from any address
performUpkeep(data) -> LINK balance decreases, and no access control prevents it.
Recommended Mitigation: Restrict callers to the Chainlink Keeper registry:
function performUpkeep(bytes calldata performData) external override {
+ require(msg.sender == s_keeperRegistry, "Only Keeper registry");
...
}
Updates
Appeal created
bube 4 months ago
Submission Judgement Published Assigned finding tags:
Anyone can call `performUpkeep` function
The `performUpkeep` function should be called by the Chainlink keepers or owners of the NFT. But there is no access control and anyone can call the function. This leads to malicious consumption of the user's LINK deposit.
Rewards breakdown
nSLOC
236This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.