Root + Impact

The burn function in BidBeasts_NFT_ERC721.sol calls _burn(_tokenId) directly and emits BidBeastsBurn(msg.sender, _tokenId). While OpenZeppelin’s _burn ensures the caller is either the owner or an approved operator, the emitted event misleadingly attributes the burn action to msg.sender instead of the actual token owner. This creates a mismatch between on-chain reality and off-chain tracking data.

Description

• The burn function in the BidBeasts contract doesn't validate that msg.sender is the owner of the token being burned. The function calls _burn directly without ownership checks, relying entirely on the inherited ERC721 implementation. While OpenZeppelin's _burn does check ownership, the event emitted suggests msg.sender burned the token when it might not be the owner.

Risk

Likelihood:

• This occurs whenever an approved operator (not the owner) calls burn, since the event will misleadingly attribute the action to msg.sender.

• This occurs consistently for all such burns, meaning any NFT with delegated approvals is affected.

Impact:

• The misleading event emission could cause confusion in off-chain systems tracking token burns. Additionally, if the OpenZeppelin implementation changes or if approved operators can burn tokens, the event would incorrectly attribute the burn to msg.sender rather than the actual token owner.

• Misleading event attribution: Off-chain systems (indexers, explorers, analytics) may incorrectly record that the operator (e.g., msg.sender) burned their own token, rather than burning the owner’s token.

• Future fragility: If the underlying ERC721 implementation changes, or if burn rights are expanded to approved operators, this design could further amplify discrepancies and misattributions.

• Ecosystem trust risk: Confusion in audit logs, compliance systems, or marketplaces that rely on events for token lifecycle tracking.

Proof of Concept

1. Alice owns token #1 and approves Bob

2. Bob calls burn(1)

3. Event emitted: BidBeastsBurn(Bob, 1) - suggesting Bob burned his own token

4. Reality: Bob burned Alice's token as an approved operator

Recommended Mitigation

Update the burn function to explicitly validate and attribute burns to the token owner