Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

ERC721 Burn function does not enforce Access Control

iafrika

Root + Impact

Description

*The burn function in BidBeasts_NFT_ERC721.sol is declared as public, allowing anyone to call it and burn any NFT token by its ID. No access control is enforced, so unauthorized actors can arbitrarily destroy tokens they do not own.


// Root cause in the codebase with @> marks to highlight the relevant section
> [BidBeasts_NFT_ERC721.sol#L23-L26](https://github.com/CodeHawks-Contests/2025-09-bid-beasts/blob/449341c55a57d3f078d1250051a7b34625d3aa04/src/BidBeasts_NFT_ERC721.sol#L23-L26)
```solidity
function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood: High
Any user can call this function at any time, making the attack trivial and frequent.

  • Whenever any external account calls burn, the specified token is destroyed regardless of ownership.

  • No checks are performed to restrict burning to the token's owner or an approved operator.

Impact:

  • Any NFT in the contract can be destroyed by any user.

  • Loss of user assets and trust, potentially irrecoverable financial and reputational damage.

Proof of Concept

// Anyone can destroy someone else's NFT, even without approval
bidBeasts.burn(tokenId); // caller does NOT need to own `tokenId`

If tokenId belongs to victimAddress, an attacker can call burn(tokenId) and destroy the victim’s NFT. Since there is no ownership check, this can be done repeatedly and at scale.

Recommended Mitigation

Restrict burning so only the owner or an approved operator can burn their tokens.

- function burn(uint256 _tokenId) public {
- _burn(_tokenId);
- emit BidBeastsBurn(msg.sender, _tokenId);
- }
​
+ function burn(uint256 _tokenId) public {
+ require(
+ _isApprovedOrOwner(msg.sender, _tokenId),
+ "Not owner nor approved"
+ );
+ _burn(_tokenId);
+ emit BidBeastsBurn(msg.sender, _tokenId);
+ }

  • Use the standard _isApprovedOrOwner ERC721 helper for access control.

Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!