Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No Access Control In BidBeasts_NFT_ERC721::burn Allows Anyone To Burn NFT Tokens

0xgutzzz

No Access Control In BidBeasts_NFT_ERC721::burn Allows Anyone To Burn NFT Tokens

Description

  • The burn function in BidBeasts_NFT_ERC721 allows anyone to burn NFT tokens without performing checks to verify that the caller is the owner of the NFT. This can lead to huge financial losses for the NFT owners.


function burn(uint256 _tokenId) public {
//@audit --> Lack of access control, anyone can burn anyone's token
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

There's a high likelihood of this happening since the burn function is a public function allowing anyone to call it

Impact:

  • Malicious actors can permanently destroy valuable NFTs belonging to other users, resulting in financial loss.

Proof of Concept

function test_Anyone_Can_Burn_NFT() public {
_mintNFT();
​
// Confirm SELLER owns the token
assertEq(nft.ownerOf(TOKEN_ID), SELLER, "SELLER should own the NFT");
​
// BIDDER_1 (not the owner) tries to burn the NFT
vm.prank(BIDDER_1);
nft.burn(TOKEN_ID);
​
// The token should no longer exist
vm.expectRevert(abi.encodeWithSignature("ERC721NonexistentToken(uint256)", TOKEN_ID));
nft.ownerOf(TOKEN_ID);
}
​

Recommended Mitigation

Let BidBeasts_NFT_ERC721 inherit the ERC721Burnable from the OpenZeppelin Contracts, which implements the access control for burning tokens.

import {ERC721} from "@openzeppelin/contracts/token/ERC721/ERC721.sol";
+ import {ERC721Burnable} from "@openzeppelin/contracts/token/ERC721/extensions/ERC721Burnable.sol";
import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
​
+ contract BidBeasts is ERC721, ERC721Burnable, Ownable(msg.sender) {
​
​

And also implement on the burn function by modifying to this

+ function burn(uint256 tokenId) public override {
+ super.burn(tokenId); // Calls the safe OpenZeppelin burn
+ emit BidBeastsBurn(msg.sender, tokenId);
}
​
​
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!