Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

High: Unrestricted NFT burn allows anyone to destroy any token

andysakov

High: Unrestricted NFT burn allows anyone to destroy any token

Description

  • Normal behavior: Only the token owner or approved operator can burn a given ERC721 token.

  • Issue: burn(uint256) lacks authorization checks and calls _burn directly, allowing any caller to burn any token.

function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
// @> Root: Missing `_isApprovedOrOwner(msg.sender, _tokenId)` guard

Risk

Likelihood:

  • Any external caller can call burn(tokenId) at any time

  • No preconditions or approvals required

Impact:

  • Permanent loss of user NFTs

  • Denial of service on the collection

Proof of Concept

Calling .burn on any BidBeasts NFT regardless of its owner will go through and result in loss of user and platform funds.

// Foundry-style PoC: any EOA can burn a token they do not own and are not approved for.
function test_AnyoneCanBurnForeignToken() public {
BidBeasts nft = new BidBeasts();
address victim = address(0xA11CE);
address attacker = address(0xB0B);
​
// Mint tokenId 0 to victim
vm.prank(nft.owner());
nft.mint(victim);
assertEq(nft.ownerOf(0), victim);
assertEq(nft.balanceOf(victim), 1);
​
// Attacker (not owner, not approved) burns victim's token
vm.prank(attacker);
nft.burn(0);
​
// Token is gone
assertEq(nft.balanceOf(victim), 0);
vm.expectRevert(); // ERC721NonexistentToken
nft.ownerOf(0);
}

Recommended Mitigation

I recommend implementing using the _isApprovedOrOwner guard to protect this function from unauthorized burns.

- function burn(uint256 _tokenId) public {
- _burn(_tokenId);
- emit BidBeastsBurn(msg.sender, _tokenId);
- }
+ function burn(uint256 _tokenId) public {
+ require(_isApprovedOrOwner(msg.sender, _tokenId), "Not owner nor approved");
+ _burn(_tokenId);
+ emit BidBeastsBurn(msg.sender, _tokenId);
+ }
Updates

Lead Judging Commences

cryptoghost Lead Judge 27 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.