The Flow NFT architecture specifies that NFTs minted under this system should not be burnable, as burning an NFT would disrupt intended functionality and may result in the permanent loss of user funds. However, in the current implementation, there is no restriction on burning by transferring the NFT to the zero address. Consequently, if an NFT is marked as transferable, it can be inadvertently burned by the recipient, violating the intended behavior.
1. **Burnability of Flow NFTs**:
- The `_update` function is intended to prevent transfers to the zero address to safeguard against accidental burns. However, the implementation currently lacks a restriction for transfers to the zero address, making the Flow NFT burnable.
- As a result, if the NFT is transferable, a recipient or approved third party may send the NFT to the zero address, effectively burning it, which is counter to the intended immutable nature of Flow NFTs.
2. **Code Analysis**:
- The `_update` function currently checks the `isTransferable` flag and permits transfers if the NFT is transferable. However, it does not include a check to revert transactions where the `to` address is set to zero.
- This omission allows a transferrable Flow NFT to be sent to the zero address, thus being permanently lost without recovery, which directly contradicts the design.
The ability to burn Flow NFTs presents several risks and potential issues:
- **Loss of Funds**: The burnability of Flow NFTs may lead to the unintended destruction of assets, leading to irrecoverable loss of funds for users (Sender).
- **Broken Functionality**: Burning disrupts the Flow architecture’s operational structure, causing failures in processes that rely on active Flow NFTs.
Manual Review
1. **Restrict Transfers to Zero Address**:
- Modify the `_update` function to include a check that reverts any transactions where the `to` address is set to zero. This will ensure that recipients or approved parties cannot burn Flow NFTs by transferring them to the zero address.
Or a transfer to the to address 0 should be prevented as long as the NFT has not been voided.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.