Root + Impact

Description

• Normal behavior:

  For burns, ERC-721 already emits Transfer(owner, address(0), tokenId). If a custom burn event is used, its from field should reflect the token’s owner at the moment of burn (or the approved operator if your schema requires it) so indexers, analytics, and monitoring systems capture accurate provenance.

  
  

• Specific issue:

  BidBeastsBurn emits msg.sender as from, not the actual owner. When an approved operator (or in the current code, any caller) burns a token, the event falsely attributes the burn to the caller, corrupting off-chain history, dashboards, and forensic pipelines.

  
  

Risk

Likelihood:

• Any burn execution will produce a misleading from in BidBeastsBurn because the code always uses msg.sender.

• This happens regardless of who initiates the burn (owner, approved operator, or arbitrary caller under the current unrestricted burn).\

Impact:

• Off-chain indexers and explorers attributing burns to the caller will record incorrect provenance, harming investigations, analytics, royalty/accounting systems, or alerting.

• Wallets and monitoring tools relying on the custom event may display wrong actors, causing user disputes and reputational damage.

Proof of Concept

Recommended Mitigation

1. Emit the actual owner (pre-burn) instead of msg.sender, or simply rely on the ERC-721 Transfer event and remove the custom burn event.