Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of Access Control on burn function allows anyone to burn all NFT token

mentemdeus

Lack of Access Control on burn function allows anyone to burn all NFT token

Root + Impact

Description

Normally, an NFT burn function should only allow the owner of the token or an approved operator to destroy the NFT.

In this code, there is no access control in place, which means any external account can burn NFTs owned by any user. This results in unauthorized destruction of assets.

function burn(uint256 _tokenId) public {
@> _burn(_tokenId); // @audit no ownership or approval check before burning
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

Every time the burn function is called, there is no restriction on the caller.

Any user who knows or guesses a valid tokenId can invoke this function and permanently burn NFTs they don’t own.

Impact:

User's NFTs can be destroyed without consent.

Proof of Concept

An attacker can simply call the function with any victim’s tokenId:

function test_burnUserTokenid() external {
_mintNFT();
_listNFT();
vm.prank(BIDDER_1); //serves as the attacker
nft.burn(TOKEN_ID);
​
​
​
​
}
​
​
​

Recommended Mitigation

Require that the caller is either the owner or approved operator of the token before allowing burning:

function burn(uint256 _tokenId) public {
+ require(_isApprovedOrOwner(msg.sender, _tokenId),"Caller is not owner nor approved");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
​
​
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!