Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unrestricted Access to Burn Function Allows Arbitrary Token Destruction

ratt13snak3

Unrestricted Access to Burn Function Allows Arbitrary Token Destruction

Description

The BidBeasts::burn function should only allow the contract owner or the token owner to destroy a token, ensuring that only authorized parties can remove NFTs from circulation. In the current implementation, the burn function is declared as public without any access control, allowing any address to call it and burn any token, regardless of ownership.

function burn(uint256 _tokenId) public {// q should this be onlyOwner?
@> _burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • Any external user can call the burn function at any time.

  • There is no restriction based on token ownership or contract ownership.'

Impact:

  • Any NFT in the contract can be destroyed by anyone, leading to permanent loss of user assets.

  • Users would lose trust in the contract and platform due to the risk of unauthorized token destruction.

Proof of Concept

paste the code below in the test suite BidBeastsMarketPlaceTest.t.sol

function test_any_user_can_burn_NFT() public {
// Mint NFTs to users of the protocol
_mintNFT(SELLER);
_mintNFT(BIDDER_1);
// assert they have balances
assertEq(nft.balanceOf(SELLER), 1, "Seller should own 1 NFT");
assertEq(nft.balanceOf(BIDDER_1), 1, "Bidder1 should own 1 NFT");
​
// simulate a random user calling the burn function
vm.prank(BIDDER_2);
nft.burn(TOKEN_ID);
nft.burn(TOKEN_ID + 1);
​
//assert the NFTs were burned.
assertEq(nft.balanceOf(SELLER), 0, "NFT should be burned");
assertEq(nft.balanceOf(BIDDER_1), 0, "NFT should be burned");
}
​

Recommended Mitigation

Restrict the burn function so only the contract owner or the token owner can call it. For contract owner only:

function burn(uint256 _tokenId) public onlyOwner {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Or, to allow token owners to burn their own tokens:

function burn(uint256 _tokenId) public {
require(ownerOf(_tokenId) == msg.sender, "Not token owner");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!