Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unrestricted Burn Function Allows Unauthorized NFT Destruction

0xh4145

Description

The burn(uint256 _tokenId) function currently allows any external caller to burn any token, regardless of ownership or approval status:

function burn(uint256 _tokenId) public {
@> _burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
​

Since the function does not verify that msg.sender is either the owner of the token or an approved operator, attackers can arbitrarily destroy NFTs belonging to other users. This undermines the integrity of the NFT collection and directly impacts holders.

Risk and Impact

  • Risk: High – trivial to exploit, does not require special privileges.

  • Impact: High – attackers can permanently destroy NFTs of other users.

Severity: High – immediate loss of assets with no recovery possible.

PoC

  1. Victim owns NFT with tokenId = 1.

  2. Attacker calls:

function test_anyOneCanBurn() external {
_mintNFT();
_listNFT();
nft.burn(TOKEN_ID);
​
vm.expectRevert();
assertEq(nft.ownerOf(TOKEN_ID), address(SELLER)); // This will revert since the token is burned
}

  1. The contract executes _burn(TOKEN_ID) without checking permissions.

  2. Victim’s NFT is permanently destroyed, even though they never approved or initiated the action.

Recommended Mitigation

Restrict the burn function to the token owner or an approved operator by adding an ownership check:

function burn(uint256 _tokenId) public {
require(_isApprovedOrOwner(msg.sender, _tokenId), "Not owner nor approved");
address owner = ownerOf(_tokenId);
_burn(_tokenId);
emit BidBeastsBurn(owner, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.