Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can burn a GDNFT

crazycelery

burn() does not check who is the msg.sender + anyone can burn anyone else's GDNFT

Description

  • Only the current owner of the GDNFT should be able to burn their token.

  • Anyone can burn anyone else's GDNFT.

function burn(uint256 _tokenId) public {
@> // no checks for who is the msg.sender here
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
​

Risk

Likelihood:

  • Occurs if anyone calls the burn() function.

Impact:

  • Anyone can burn anyone else's GDNFT.

Proof of Concept

Add this to tests/BidBeastsMarketPlaceTest.t.sol.

import {IERC721Errors} from "../lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol";
​
function test_anyoneCanBurnNFT() public {
_mintNFT();
​
// SELLER is the current owner of the GDNFT 0
address owner = nft.ownerOf(TOKEN_ID);
assertEq(owner, SELLER, "NFT should be held by the SELLER");
​
// BIDDER_1 calls burn() on GDNFT 0
vm.startPrank(BIDDER_1);
nft.burn(TOKEN_ID);
vm.stopPrank();
​
// GDNFT 0 is burnt
vm.expectRevert(
abi.encodeWithSelector(
IERC721Errors.ERC721NonexistentToken.selector,
TOKEN_ID
)
);
nft.ownerOf(TOKEN_ID);
}
​

Run with:

forge test -vvv BidBeastsMarketPlaceTest.t.sol --match-test test_anyoneCanBurnNFT

Sample output:

[⠊] Compiling...
[⠊] Compiling 1 files with Solc 0.8.20
[⠒] Solc 0.8.20 finished in 902.37ms
Compiler run successful!
​
Ran 1 test for test/BidBeastsMarketPlaceTest.t.sol:BidBeastsNFTMarketTest
[PASS] test_anyoneCanBurnNFT() (gas: 73489)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.20ms (598.67µs CPU time)
​
Ran 1 test suite in 15.79ms (2.20ms CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests)
​

Recommended Mitigation

Add a check for the msg.sender to be the current owner of the GDNFT to burn().

function burn(uint256 _tokenId) public {
+ require(ownerOf(_tokenId) == msg.sender, "You do not own the NFT");
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.