Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

access control vulnerability allows NFT burning

themo2

Unauthorized NFT Burning due to missing access control

Description

  • The burn function should only allow the owner or approved operators of an NFT to burn it, following standard ERC721 authorization patterns.

  • The current implementation allows any address to burn any NFT without checking ownership or approval permissions, enabling malicious actors to destroy valuable assets.

function burn(uint256 _tokenId) public {
@> // No authorization check before burning
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • Any malicious user can call the burn function at any time with any valid token ID

  • NFTs listed on the marketplace are particularly vulnerable as they are highly visible and valuable targets

Impact:

  • Complete and irreversible destruction of users' valuable NFT assets

  • Listed NFTs on the marketplace can be burned by griefers, causing financial loss to sellers and disrupting auctions

Proof of Concept

function test_onlyOwnerCanBurnNFT() public {
_mintNFT();
assertEq(nft.ownerOf(TOKEN_ID), SELLER, "NFT should be held by the market");
// BIDDER_2 is not the owner we will use the address to act as an attacker
vm.prank(BIDDER_2);
nft.burn(TOKEN_ID);
// nft.ownerOf(TOKEN_ID) will revert because the token Id is burnt
assertEq(nft.ownerOf(TOKEN_ID), SELLER, "NFT shouldn't be burned");
}

Recommended Mitigation

function burn(uint256 _tokenId) public {
+ require(msg.sender == ownerOf(_tokenId), "Not authorized to burn");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.