Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can burn any NFT

ciphermalware

Root + Impact

Description

  • The burn function in BidBeasts NFT should only allow token holders to burn their own NFTs so that owners can destroy their tokens permanently from circulation

  • The burn function is completely unsafe and allows any address to burn any token ID without checking for ownership which can be abused to burn listed NFTs and freeze bidder funds in the marketplace contract permanently

function burn(uint256 _tokenId) public {
_burn(_tokenId); // @> No ownership check, anyone can burn any token
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • Literally any external address can call the burn function at any time with any valid token ID

  • This requires no special access nor persmisions

Impact:

  • Complete destruction of any NFT in the collection

  • Bidder funds become permanently locked

Proof of Concept

// Test to demonstrate how attacker can burn listed NFT and lock funds
function testBurnListedNFTLocksFunds() public {
// Setup: Alice owns NFT #1
address alice = address(0x1);
address bob = address(0x2);
address attacker = address(0x666);
vm.startPrank(owner);
nft.mint(alice, 1);
vm.stopPrank();
// Alice lists her NFT for auction
vm.startPrank(alice);
nft.approve(address(marketplace), 1);
marketplace.listNFT(1, 1 ether, 5 ether);
vm.stopPrank();
// Bob places a bid
vm.deal(bob, 2 ether);
vm.prank(bob);
marketplace.placeBid{value: 2 ether}(1);
// Attacker burns the NFT
vm.prank(attacker);
nft.burn(1);
// Auction end time passes
vm.warp(block.timestamp + 15 minutes);
​
vm.expectRevert("ERC721: invalid token ID");
marketplace.settleAuction(1);
​
}

Recommended Mitigation

function burn(uint256 _tokenId) public {
+ require(ownerOf(_tokenId) == msg.sender, "Only owner can burn");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!