Bid Beasts

Description:

The BidBeasts ERC721 contract contains a critical vulnerability in its burn() function that allows any user to burn (permanently destroy) any existing NFT without authorization checks. The function directly calls the internal _burn() method without verifying that the caller is the token owner or has been approved to manage the token. This occurs because the _burn() function passes address(0) as the authorization parameter to _update(), which bypasses OpenZeppelin's built-in authorization checks.

Attack path:

1. Attacker identifies any existing NFT token ID in the BidBeasts collection

2. Attacker calls burn(tokenId) function with the target token ID

3. The function executes without checking if the attacker owns the token or has approval

4. The NFT is permanently destroyed, removing it from the owner's balance and clearing its ownership record

5. The attack can be repeated for any number of tokens, potentially destroying the entire collection

Impact:

Any NFT in the collection can be permanently destroyed by malicious actors

PoC

Place below in BidBeastsMarketPlaceTest.t.soland run forge test --mt test_burnNFT

Recommended Mitigation:

Replace the current burn() function with a properly authorized version that includes ownership or approval checks: