Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unprotected burn function - unauthorized token destruction

sharonilukhor

Missing ownership verification in the burn function + Permanent loss of assets

Description

The burn function lacks ownership verification, allowing any user to destroy any token. This creates a critical security vulnerability where malicious actors can burn tokens they don't own, leading to permanent loss of assets.

Direct Asset Loss: Malicious actors can burn tokens they don't own, leading to permanent destruction of valuable NFTs with no recovery mechanism for destroyed assets.


Protocol Disruption: The exploitation can lead to loss of user trust in the platform and potential market value collapse, ultimately resulting in complete protocol compromise.


Economic Impact: The vulnerability enables financial losses for token holders and market confidence erosion, potentially leading to protocol collapse.


Likelihood:

  • No warning sign present

  • Simple to exploit

Impact:

  • Any user can destroy any token

  • Complete contract compromise

Proof of Concept

// Malicious user can burn any token
function exploit(address victim, uint256 tokenId) public {
// No checks prevent this
victimContract.burn(tokenId); // Burns victim's token
}

Recommended Mitigation

- function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
+ function burn(uint256 _tokenId) public {
require(ownerOf(_tokenId) == msg.sender, "Only owner can burn");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.