Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Access Control on `BidBeasts_NFT_ERC72::burn()` Function

mishraji874

Description

  • The normal behavior should be that only the token owner or approved accounts can burn an NFT token.

  • The BidBeasts_NFT_ERC72::burn() function has no access control checks, allowing any address to burn any NFT token regardless of ownership or approval status.

function burn(uint256 _tokenId) public {
@> _burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • Any malicious actor can call the burn function at any time for any existing token

  • No authentication or authorization checks prevent unauthorized burning

Impact:

  • Complete loss of NFT assets for legitimate owners

  • Permanent destruction of valuable digital assets without consent

Proof of Concept

function test_HIGH_UnauthorizedBurn() public {
// Mint NFT to Alice
vm.prank(OWNER);
uint256 tokenId = nft.mint(ALICE);
​
// Verify Alice owns the NFT
assertEq(nft.ownerOf(tokenId), ALICE, "Alice should own the NFT");
​
// Attacker burns Alice's NFT without permission
vm.prank(ATTACKER);
nft.burn(tokenId);
​
// Verify NFT is burned (should revert on ownerOf call)
vm.expectRevert("ERC721: invalid token ID");
nft.ownerOf(tokenId);
}

Recommended Mitigation

- function burn(uint256 _tokenId) public {
+ function burn(uint256 _tokenId) public {
+ require(_isAuthorized(msg.sender, _tokenId), "Not authorized to burn this token");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.