Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unauthorized NFT Burn — anyone can destroy tokens

raminidalf

Root + Impact

Description

  • Normal behavior: burn should only allow the token owner or an approved operator (or a privileged role) to permanently destroy a token.

  • Issue: burn(uint256) is public and lacks any ownership/approval check, allowing any caller to burn any

// Root cause in the codebase with @> marks to highlight the relevant section
contract BidBeasts is ERC721, Ownable(msg.sender) {
​
...
// @> No ownership/approval check here — any address can call burn
function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
}
​

Risk

Likelihood:

  • Any externally owned account (EOA) or malicious contract can call burn at any time after the token exists — occurs whenever a token exists on-chain and burn is callable.

Scripts or bots scanning for high-value tokens can mass-invoke burn rapidly against targets.

Impact:

  • Permanent destruction of users' NFTs (loss of asset and associated metadata).

  • Breaks marketplace assumptions (listed/sold tokens may be burned mid-flow), causing fund-logic inconsistencies.

Proof of Concept

// Minimal exploit sequence (from any EOA)
BidBeasts(bidBeastsAddress).burn(victimTokenId);
// After this call the token is burned regardless of caller.
​

Recommended Mitigation

@@
- function burn(uint256 _tokenId) public {
- _burn(_tokenId);
- emit BidBeastsBurn(msg.sender, _tokenId);
- }
+ function burn(uint256 tokenId) public {
+ // allow only owner or approved operator to burn
+ require(_isApprovedOrOwner(_msgSender(), tokenId), "Not owner nor approved");
+ _burn(tokenId);
+ emit BidBeastsBurn(_msgSender(), tokenId);
+ }
​
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.