Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The `BidBeasts_NFT_ERC721::burn` function does not have any checks to prevent attackers from burning NFT's.

bigal

Root + Impact

Description

  • In the `BidBeasts_NFT_ERC721` when someone wants to burn their NFT, they would call the `BidBeasts_NFT_ERC721::burn` function.

  • However, in `BidBeasts_NFT_ERC721::burn`, there are no checks to prevent anyone from calling this function, and to burn someone elses NFT.

@> function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • This attack will occur when a malicous wallet calls the `BidBeasts_NFT_ERC721::burn` function on the contract with someone elses token ID to burn their NFT.

Impact:

  • A users NFT will be burned and potential money he could have made would be gone.

Proof of Concept

  1. The owner of the `BidBeastsNFTMarketPlace.sol` mints an NFT.

  2. This owner gives the NFT to a seller.

  3. This seller decides to sell the NFT given to him and lists it on on the `BidBeastsNFTMarketPlace.sol

  4. Before anyone can buy his NFT, an attacker calls the `BidBeasts_NFT_ERC721::burn` function and burns his NFT.

  5. The seller lost his NFT.

    *Side note: The sellers NFT can be burned even if it is not listed in the marketplace.

function test_burnAPoorUsersNFTOutOfHatredForThisWorld(){
// The owner mints an NFT for the seller
_mintNFT();
// The seller lists the NFT
_listNFT();
// An attacker is summoned
address attacker = makeAddr("attacker");
vm.startPrank(attacker);
// The attacker burns the NFT
nft.burn(TOKEN_ID);
vm.stopPrank();
}

Recommended Mitigation

Add a check to the `BidBeasts_NFT_ERC721::burn` that only allows the owner of an NFT to burn his NFT.

function burn(uint256 _tokenId) public {
+ require(_ownerOf(_tokenId) == msg.sender, "Not the token owner");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!