Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can burn any token even if it's not theirs

0xziin

Root + Impact

Description

function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood: High

  • It occurs each time someone calls the burn() function with the _tokenId of the NFT they want to burn as a parameter.

Impact: High

  • They can just burn any token they want without even owning it.

Proof of Concept

=> Call the burn() function with a _tokenId from a token ou do not own. Check that the token is indeed burnt.

Recommended Mitigation

=> Only allow the owner of the token to be able to burn it.

Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.