Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Due to the lack of access control, anyone can burn any BidBeast NFT

farnad

Root + Impact

Description

  • The BidBeasts::burn() function does not have any access control in place (like the onlyOwner() modifier or a similar mechanism), therefore, any user can call this function and burn tokens which belong to other users. It severly impacts the correct working of the contract and disrupts its functionality.

// Root cause in the codebase with @> marks to highlight the relevant section
@> function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
​

Risk:

It will hurt the trust users have in the system because they can lose their NFTs for no reason. Therefore, it completely breaks the app.

Impact:

  • Anyone can arbitrarily burn any NFT and damage the functionality and trustworthiness of the system.

Proof of Concept

  1. Call BidBeasts::burn() function passing an existing tokenId (with an account other than the owner).

  2. The NFT with that tokenId does not exist anymore.


Add the following code to the test file.

function test_AnyoneCanBurnAnyNFT() public {
_mintNFT();
assert(nft.ownerOf(TOKEN_ID) == SELLER);
​
// BIDDER_1 burns the NFT
vm.prank(BIDDER_1);
nft.burn(TOKEN_ID);
​
// Check that the NFT no longer exists
vm.expectRevert();
nft.ownerOf(TOKEN_ID);
}
​

Recommended Mitigation

Add the onlyOwner() modifier to the BidBeasts::burn() function.

- function burn(uint256 _tokenId) public {
+ function burn(uint256 _tokenId) public onlyOwner() {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.