Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Misleading Data in BidBeastsBurn() Event

objectplayer

Root + Impact

The burn() function emits an event where the from address is incorrectly logged as msg.sender instead of the actual token owner, creating misleading logs and potentially hiding malicious activity.

Description

  • When a token is burned by the owner of token holder, the event should correctly reflect the address from which the token was removed (the true token owner).

  • The BidBeastsBurn event emits msg.sender instead of the actual token owner, which causes inaccurate logs, if it is called by any malicious address, as method is public and anyone can call this method.

function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId); // ❌ Wrong: should log token owner
}

Risk

Likelihood: Medium

  • Any user calling burn() will always be logged as the "owner," regardless of whether they owned the NFT.

  • Logs are widely used in audits, analytics, or disputes. Incorrect data is very likely to cause issues.

Impact: Low

  • Logs do not match actual state transitions and Misleads off-chain monitoring systems or compliance checks.

  • Misrepresentation of ownership history, breaking trust with marketplaces or analytics tools.

Proof of Concept

Consider Alice owns token #1. If Bob calls burn(1), the event will log Bob as the one who "burned" it, even though the token was removed from Alice’s balance.

// Simulation in JavaScript with ethers.js
await contract.connect(alice).mint(alice.address); // Alice owns token #1
​
// Bob maliciously calls burn
await contract.connect(bob).burn(1);
​
// Event log output
// BidBeastsBurn(from=Bob, tokenId=0)
// ❌ Should have been Alice

Recommended Mitigation

Retrieve the actual owner of the token before burning and emit it in the event.

function burn(uint256 _tokenId) public {
- _burn(_tokenId);
- emit BidBeastsBurn(msg.sender, _tokenId);
+ address owner = ownerOf(_tokenId);
+ _burn(_tokenId);
+ emit BidBeastsBurn(owner, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!