Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The function _burn lacks permission control checks

kevin1115

Root + Impact

Description

  • The function _burn lacks permission control checks, anyone can call burn(_tokenId).

// @notice _burn(_tokenId) function lacks permission control checks;
function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • Anyone can destroy someone else's NFT .

    NFTs with market value could be burned by malicious attackers.

    This severely undermines the security of the contract.

Impact:

  • NFTs with market value could be burned by malicious attackers.

    This severely undermines the security of the contract.

Proof of Concept

function test_burn_NoAccessControl_Vulnerability() public {
_mintNFT();
// Verify NFT existence
assertEq(nft.ownerOf(TOKEN_ID), SELLER, "NFT should be owned by SELLER");
// The attacker (non-owner) attempts to destroy someone else’s NFT
vm.prank(BIDDER_1); // Using BIDDER_1 as attacker
nft.burn(TOKEN_ID); // This should fail, but the current implementation allows anyone to destroy any NFT
// Verify that the NFT has been destroyed (this proves the vulnerability exists)
vm.expectRevert(); // Attempts to obtain a destroyed NFT should fail
nft.ownerOf(TOKEN_ID);
}
​

Recommended Mitigation

function burn(uint256 _tokenId) public {
require(_isApprovedOrOwner(msg.sender, _tokenId), "Not owner nor approved");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
function test_burn_ShouldOnlyAllowOwnerOrApproved() public {
_mintNFT();
// The correct behavior should be: only the holder or authorized person can destroy
vm.prank(SELLER); // Holders destroy their own NFTs
nft.burn(TOKEN_ID);
// Verify that the NFT has been destroyed
vm.expectRevert();
nft.ownerOf(TOKEN_ID);
}
​
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!