Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can burn arbitrary NFTs

kode_n_rolla

At BidBeasts_NFT_ERC721::burn anyone can burn arbitrary NFTs

Description

  • Normal behavior:
    The burn function in an ERC721 implementation should only allow the owner of a token or an approved operator to destroy the token. This ensures that only authorized accounts can remove NFTs from circulation.

  • Issue:

    In BidBeasts_NFT_ERC721.sol, the burn function is declared public and directly calls the internal _burn function without any ownership or approval checks. As a result, any address can burn any existing token, simply by knowing its tokenId.

function burn(uint256 _tokenId) public {
@> _burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • This occurs whenever an arbitrary user calls burn with a valid tokenId.

  • No prior authorization or ownership is required, making the attack trivial.

Impact:

  • An attacker can permanently destroy NFTs they do not own, leading to a total loss of user assets.

  • This undermines trust in the NFT collection and marketplace, and may result in a mass Denial-of-Service for the project.

Proof of Concept

Place the following into BidBeastsMarketPlaceTest.t.sol

function test_anyoneCanBurnNFT() public {
// Mint NFT to SELLER
_mintNFT();
assertEq(nft.ownerOf(TOKEN_ID), SELLER);
​
// BIDDER_1 (not the owner) burns SELLER's NFT
vm.prank(BIDDER_1);
nft.burn(TOKEN_ID);
​
// Token no longer exists
vm.expectRevert();
nft.ownerOf(TOKEN_ID);
}

Recommended Mitigation

Restrict the burn function by following the OpenZeppelin ERC721Burnable pattern. Require that the caller is either the token owner or an approved operator:

function burn(uint256 tokenId) public {
+ require(_isApprovedOrOwner(msg.sender, tokenId), "Not owner nor approved");
_burn(tokenId);
emit BidBeastsBurn(msg.sender, tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!