Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unrestricted Burn Function Allows Any User to Destroy Arbitrary NFTs

0xrayaa

Root + Impact

Description

  • Normal behavior:

    In a standard ERC-721 implementation, the burn function can only be called by the token owner or an approved operator. This ensures that NFTs cannot be destroyed by arbitrary third parties.

  • Specific issue:

    In the current implementation, the burn function is declared public and directly calls _burn(_tokenId) without validating ownership or approval. This means any external account can call burn on any token ID, regardless of whether they own it.


function burn(uint256 _tokenId) public {
@> _burn(_tokenId); //@audit no access control
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • The function is public, meaning it is always accessible to any externally owned account (EOA).

  • The missing _isApprovedOrOwner check ensures that the attack does not depend on any specific state or configuration.


Impact:

  • Attackers can destroy NFTs owned by other users, leading to permanent loss of assets.

  • This can erode trust in the collection, devalue the marketplace listings, and damage the project’s reputation.


Proof of Concept

// Assume victim owns tokenId = 5
// Attacker contract or EOA directly calls:
BidBeasts(bidBeastsAddress).burn(5);
​
// Effect:
// - Victim's NFT with ID 5 is destroyed.
// - Attacker did not need approval or ownership.
// - Victim suffers asset loss.

Recommended Mitigation

  • Restrict burn permissions to only the owner or approved operator by adding a check.

  • Alternatively, remove the custom implementation and inherit OpenZeppelin’s ERC721Burnable, which already provides a secure burn method.

function burn(uint256 _tokenId) public {
+ require(_isApprovedOrOwner(_msgSender(), tokenId), "Not owner nor approved");
_burn(_tokenId); //@audit no access control
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!