All the Chainlink Functions demo's I have seen show that the function executeRequest can only be called by the contract owner. I understand why they did that because of the cost when calling the Chainlink function that the funded and deployed contract pays. However if I remove the onlyOwner modifier and subtract a fee (that will cover the costs, which I can ensure with pricefeeds that it will be enough) for anybody calling the endpoint is there still an attack vector left? I will require check if the fee is substantial enough otherwise the contract won't call req.initializeRequest but curious if there are any other things I need to consider?

PS: I understand that the contract responsible for the the Chainlink function call needs to have enough LINK, but that is more an UX issue when the call can't be done

1 Answer 1


Someone can send arbitrary requests using your subscription, draining your subscription balance.

If users want to remove onlyOwner in favor of some other method to prevent this, that is fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.