Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Access Control on NFT Burn Function

r4ck3

There is no check whether the owner of the nft is the one initiating the burning of the nft resulting in permanent loss of the nft

Description

  • Owner of the nft is able to call the burn function on his owned nft by providing the tokenId as an argument to the burn function.

  • Problem is that owner of the token is not the only one that can burn his nft, in fact it is everyone who can supply his token id resulting in owners permanent loss of nft.

@> function burn(uint256 _tokenId) public {
@> _burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • This occurs when malicious actor calls the burn function which is callable by everyone and provides the id of the token he is not an owner of.

Impact:

  • Results in the permanent loss of the users NFTs.

Proof of Concept

Place this function inside of the BidBeastsMarketPlaceTest.t.sol inside of the contract BidBeastsNFTMarketTest

​
function testUnauthorizedBurnNft() public {
vm.startPrank(OWNER);
nft.mint(SELLER);
vm.stopPrank();
​
assertEq(nft.ownerOf(0), SELLER);
assertEq(nft.balanceOf(SELLER), 1);
​
vm.prank(BIDDER_1);
nft.burn(0);
​
assertEq(nft.balanceOf(SELLER), 0);
​
vm.expectRevert();
nft.ownerOf(0);
}
​

Recommended Mitigation

By simply adding a check whether the owner of the token is msg.sender it would be impossible for someone else to burn someone elses nft.

In src/BidBeasts_NFT_ERC721.sol
​
function burn(uint256 _tokenId) public {
+ require(msg.sender == ownerOf(_tokenId));
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!