Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-2] An attacker can burn any BidBeast NFT

emerjux

Root + Impact

Description

  • When you own an NFT is supposed to belong to you and nobody can interact with it.

  • In this case the BidBeast NFT can be burned by anyone at any moment.

@>function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • If someone sells its BidBeast NFT an attacker can burn it after the sell.

  • A resented bidder decides to take vengeance by destroying the BidBeast NFT godie after being outbidded.

Impact:

  • The bidder doesn't have the proof of being a BidBeast NFT and never owns it, creating a lack of social acceptance in the Bid community.

  • The proud owner of the BidBeast NFT discovers that everything was a scam.

Proof of Concept

The following test should pass but it returns [FAIL: ERC721NonexistentToken(0)] because the line 17 is triggered by the bidder 1 and not the owner of the NFT at that moment.

function test_burning_neighbor_nft() public {
_mintNFT();
_listNFT();
​
// First Bid
uint256 first_bid = MIN_PRICE + 1 ether;
vm.prank(BIDDER_1);
market.placeBid{value: first_bid}(TOKEN_ID);
​
// Second Bid
uint256 second_bid = first_bid * 120 / 100; // 20% increase
vm.prank(BIDDER_2);
market.placeBid{value: second_bid}(TOKEN_ID);
​
// Bidder 1 is pissed and destroys the NFT
vm.prank(BIDDER_1);
nft.burn(TOKEN_ID);
​
// The auction finishes and the rightful winner doesn't get his NFT
vm.warp(block.timestamp + 1 days);
vm.prank(SELLER);
vm.expectRevert();
market.settleAuction(TOKEN_ID);
​
// Check if the bidder 2 got the NFT
assertEq(nft.ownerOf(TOKEN_ID), BIDDER_2, "NFT should be owned by bidder 2");
}
​

Recommended Mitigation

Add the check of onlyOwner in the burn function to be sure that only the Owner of the NFT can destroy it.

-function burn(uint256 _tokenId) public {
+function burn(uint256 _tokenId) public onlyOwner {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!