Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Insecure burn() (anyone can burn others’ tokens)

hunterspartan5

Root + Impact

Description

  • The burn(uint256) function is public and calls _burn(...) without checking that the caller is the token owner or an approved operator. This allows any account to burn (permanently destroy) any token. There should be a require statement or an modifer that only allows the owner of that particular tokenId to call this burn function and no one else should be able to call and actually put the token owner is loss.

// Root cause in the codebase with @> marks to highlight the relevant section
function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • High — trivial to exploit on-chain if present.

  • This will occur everytime.

Impact:

  • Critical — loss/destruction of user NFTs, permanent asset loss.

  • DoS if the attacker always calls this function before the token owner could list this token for bid

Proof of Concept

// Manual review

Recommended Mitigation

  • Adding the condition that only the owner and the token owner can call this function and no one else.

- function burn(uint256 _tokenId) public {
- _burn(_tokenId);
- emit BidBeastsBurn(msg.sender, _tokenId);
- }
+ /**
+ * @notice Burn a token. Only the token owner or an approved operator may burn.
+ */
+ function burn(uint256 tokenId) public {
+ require(_isApprovedOrOwner(_msgSender(), tokenId), "Not owner nor approved");
+ _burn(tokenId);
+ emit BidBeastsBurn(_msgSender(), tokenId);
+ }
​
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.