Bid Beasts

Summary

The burn function in BidBeasts_NFT_ERC721.sol is vulnerable due to missing access control. It is declared as public without ownership checks, allowing any user to burn any NFT by providing its _tokenId. This results in a critical security risk, as unauthorized parties can permanently destroy NFTs owned by others, undermining the ERC721 ownership model.

Description

The burn function in the BidBeasts_NFT_ERC721.sol contract lacks access control, allowing any user to call the function and burn any NFT (identified by _tokenId). This is a critical security vulnerability, as it permits unauthorized users to destroy NFTs that they do not own, undermining the ownership integrity of the ERC721 contract.

The function is defined as follows: https://github.com/CodeHawks-Contests/2025-09-bid-beasts/blob/449341c55a57d3f078d1250051a7b34625d3aa04/src/BidBeasts_NFT_ERC721.sol#L23

Unlike the mint function, which uses the onlyOwner modifier to restrict access to the contract owner, the burn function is marked as public without any access control checks. This allows any caller to burn any NFT, regardless of ownership.

For comparison, the mint function is properly restricted:

PoC:

Impact

• Unauthorized NFT Destruction: Any user can burn any NFT, leading to potential loss of assets for legitimate owners.

Mitigation

To mitigate this vulnerability, the burn function should include an access control mechanism to ensure that only the owner of the NFT (or the contract owner, depending on the intended design) can burn it. The following approaches are recommended:

1. Restrict to NFT Owner:
   Use the ownerOf function from the ERC721 standard to verify that the caller (msg.sender) is the owner of the _tokenId before allowing the burn operation.

   Proposed Fix:

   function burn(uint256 _tokenId) public {

   require(msg.sender == ownerOf(_tokenId), "Only the NFT owner can burn it");

   _burn(_tokenId);

   emit BidBeastsBurn(msg.sender, _tokenId);

   }