Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can burn BidBeasts tokens

al88nsk

Description

Function BidBeasts::burn does not have restrictions on who can call it. So, anyone can call it and burn tokens belonging to other accounts. The function must be available for call only by the owner.

function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood: High

Anyone can call BidBeasts::burn at any time.

Impact: High

Any token belonging to any account can be burnt by anyone.

Recommended Mitigation

Add onlyOwner modifier to the function:

-function burn(uint256 _tokenId) public {
+function burn(uint256 _tokenId) public onlyOwner {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.