Lack of access control in performUpkeep function might drain the LINK token user deposited

Description

• The performUpkeep function is intended to be called by Chainlink Keepers (Automation) to request updated weather data for NFTs when their heartbeat period is met. However, the function is declared as external with no modifiers or internal checks that would restrict who can call it to only the Chainlink Keeper Registry. As a result, any malicious actor can repeatedly call performUpkeep for multiple NFTs, even if they are not the legitimate Chainlink Keeper, thereby continuously triggering Chainlink Functions requests. Each such request consumes LINK tokens from the contract's associated Chainlink Functions subscription.

Risk

Likelihood: High

• The performUpkeep function is external and directly callable by any Ethereum address.

• An attacker can easily identify NFTs for which checkUpkeep would return true (i.e., their update heartbeat period has passed) and repeatedly call performUpkeep with the encoded tokenId for those NFTs.

Impact:

• Depletion of the contract owner's LINK tokens that fund the Chainlink Functions subscription

• Denial of service for legitimate weather updates. Once the subscription's LINK balance is depleted, valid Chainlink Keepers will no longer be able to execute performUpkeep calls, preventing the weather data for NFTs from being updated, leading to stale or inaccurate information.

Recommended Mitigation

To prevent unauthorized users from triggering Chainlink Functions requests via performUpkeep, you can restrict access to this function by verifying that msg.sender is either the trusted Chainlink Automation Registry address or the owner of the specific NFT being updated.