Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[High] Loss of User NFTs

0xhsn

[High] Loss of User NFTs

Description

The burn function in the BidBeasts NFT contract allows any address to burn any NFT, regardless of ownership. This function lacks proper access control, enabling malicious actors to permanently destroy any user's NFTs without permission.


//Audit::HIGH anyone can burn anyones token;
function burn(uint256 _tokenId) public {
@> _burn(_tokenId); // No ownership or authorization check
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • Any malicious actor can call this function at any time without restrictions

  • The function is publicly accessible and requires no special permissions

  • Attackers can systematically burn all NFTs in the collection

  • No gas cost barrier prevents mass destruction attacks

Impact:

  • Complete loss of user NFTs with no recovery mechanism

  • Destruction of marketplace listings and active auctions

  • Loss of user investment and collection value

Proof of Concept

function test_anyoneCanBurn() public {
vm.startPrank(OWNER);
uint256 id = nft.mint(SELLER);
vm.stopPrank();
​
vm.prank(BIDDER_1);
nft.burn(id);
vm.expectRevert('ERC721NonexistentToken(0)');
assert(nft.ownerOf(id) == address(0));
}

Recommended Mitigation

function burn(uint256 _tokenId) public {
+ require(_isApprovedOrOwner(msg.sender, _tokenId), "Not owner or approved");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Alternatively, consider inheriting from OpenZeppelin's ERC721Burnable which implements proper access control:

- import {ERC721} from "@openzeppelin/contracts/token/ERC721/ERC721.sol";
+ import {ERC721Burnable} from "@openzeppelin/contracts/token/ERC721/extensions/ERC721Burnable.sol";
​
- contract BidBeasts is ERC721, Ownable(msg.sender) {
+ contract BidBeasts is ERC721Burnable, Ownable(msg.sender) {
​
- function burn(uint256 _tokenId) public {
- _burn(_tokenId);
- emit BidBeastsBurn(msg.sender, _tokenId);
- }
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!