Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.