Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Cross-Contract Vulnerability: NFT Can Be Burned While Listed

mishraji874

Description

  • Listed NFTs should be protected from external manipulation while they are being auctioned and have active bids.

  • Due to the missing access control on the BidBeasts_NFT_ERC721::burn() function in the NFT contract, anyone can burn NFTs that are currently listed on the marketplace, causing auction failures and fund lockups.

function burn(uint256 _tokenId) public {
@> _burn(_tokenId); // No access control allows burning listed NFTs
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • Any attacker can burn any listed NFT at any time

  • Particularly likely to target high-value auctions with active bids

Impact:

  • Complete auction failure and inability to settle

  • Bidders' funds may be locked if auction cannot be settled properly

  • Loss of valuable NFT assets during active auctions

Proof of Concept

function test_HIGH_CrossContractBurnListedNFT() public {
uint256 tokenId = _mintAndListNFT(ALICE, MIN_PRICE, BUY_NOW_PRICE);
​
// Bob places a bid
vm.prank(BOB);
market.placeBid{value: MIN_PRICE + 0.1 ether}(tokenId);
​
// VULNERABILITY: Attacker can burn the NFT even though it's listed and has bids
vm.prank(ATTACKER);
nft.burn(tokenId);
​
// NFT is now burned but marketplace state is inconsistent
vm.expectRevert("ERC721: invalid token ID");
nft.ownerOf(tokenId);
​
// Try to settle auction - will fail due to burned NFT
vm.warp(block.timestamp + 16 minutes);
vm.expectRevert();
market.settleAuction(tokenId);
}

Recommended Mitigation

function burn(uint256 _tokenId) public {
+ require(_isAuthorized(msg.sender, _tokenId), "Not authorized to burn this token");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.