Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

burn(uint256) in BidBeasts is public and allows anyone to burn any token (permission bypass)

s3mvl4d

burn(uint256) in BidBeasts is public and allows anyone to burn any token (permission bypass)

Description

  • In an ERC721 implementation, the burn function should only be callable by the token owner or an approved operator. This prevents unauthorized users from destroying other users’ NFTs.

  • In the BidBeasts contract, the burn(uint256) function is declared public and directly calls _burn(_tokenId) without verifying ownership or approval. This exposes the function to the public and allows any account to burn arbitrary tokens, regardless of whether they own them.

function burn(uint256 _tokenId) public {
@> _burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
​

Risk

Likelihood:

  • The function is declared public, so any external account can call it at any time.

  • No access control or ownership checks are performed before burning a token.

Impact:

  • Any user can destroy NFTs belonging to other users.

  • This results in a total loss of user assets and irreversible denial-of-service for the NFT collection.

Proof of Concept

// Assume Alice owns tokenId 1 in BidBeasts
// Bob is an attacker
​
// Bob calls:
BidBeasts(bidBeastsAddress).burn(1);
​
// Result: Alice's NFT with tokenId 1 is permanently destroyed,
// even though Alice never approved Bob.
​

Recommended Mitigation

- function burn(uint256 _tokenId) public {
- _burn(_tokenId);
- emit BidBeastsBurn(msg.sender, _tokenId);
- }
​
+ function burn(uint256 tokenId) public {
+ require(_isApprovedOrOwner(msg.sender, tokenId),
+ "Not owner nor approved");
+ _burn(tokenId);
+ emit BidBeastsBurn(msg.sender, tokenId);
+ }
​
Updates

Lead Judging Commences

cryptoghost Lead Judge 22 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.