Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unrestricted access to burn() function in BidBeast_NFT_ERC721.sol

the2ke

Burn functin has no restrictions on who can burn NFT

Description

  • In the `BidBeast_NFT_ERC721.sol` contract, there are two main functions: the `mint()` and the `burn()`. To be able to to mint and burn, the user must be the owner which is shown in the `mint()` function but not in the `burn()` function.Explain the specific issue or problem in one or more sentences


  • The burn() function allows any user to burn any NFT token without ownership verification. This violates the fundamental principle of NFT ownership where only the token owner or approved addresses should be able to burn tokens.

​
@> function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • This can occurs anytime a user or seller mint an NFT

Impact:

  • Complete loss of digital assets for legitimate owners

  • Any user can permanently destroy any NFT in the collection Impact 2

Proof of Concept

Attack Scenario:
1. User A legitimately owns tokenID 5
2. User B (Attacker) calls burns(5) without any restrictions
3. tokenID 5 is permanently burned and removed from User A's wallet
4. User A is in complete loss of the NFT
address public constant MALICIOUS_USER = address(0x5);
function test_anyoneCanBurnNFT() public {
//Legitimate SELLER owns NFT ID = 0
_mintNFT();
assertEq(nft.ownerOf(0), SELLER);
​
//Malicious USER decide to burn SELLER Assets...
vm.prank(MALICIOUS_USER);
nft.burn(0);
​
//Token has been burnt ...
vm.expectRevert();
nft.ownerOf(0);
}

Recommended Mitigation

I recommand adding a Custom ownership check
function burn(uint256 _tokenId) public {
+ address owner = ownerOf(_tokenId);
+ require(owner == msg.sender, "Not owner or approved");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.