Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`BidBeasts:burn` Function Lacks Access Control Modifier

minos

BidBeasts:burn Function Lacks Access Control Modifier

Description

  • Under normal circumstances, NFT burning operations should only be executable by users with specific permissions, typically the NFT owner or contract administrator.

  • The current burn function in the contract lacks access control, allowing any user to arbitrarily burn NFTs with any tokenId, which leads to serious permission issues.

@> function burn(uint256 _tokenId) public {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}

Risk

Likelihood:

  • Anyone can call the burn function to destroy NFTs

  • This unrestricted access will be immediately exploited by malicious users

Impact:

  • NFT owners may lose their assets accidentally or maliciously

  • The overall value and credibility of the contract will be severely compromised

Proof of Concept

  • Add the following to BidBeastsMarketPlaceTest.t.sol:

import {IERC721Errors} from "@openzeppelin/contracts/interfaces/draft-IERC6093.sol";
function test__burnOtherNFT() public {
vm.startPrank(OWNER);
nft.mint(SELLER);
vm.stopPrank();
vm.assertTrue(nft.ownerOf(TOKEN_ID) == SELLER);
address anyOne = makeAddr("anyOne");
vm.prank(anyOne);
nft.burn(TOKEN_ID);
vm.prank(SELLER);
vm.expectRevert(abi.encodeWithSelector(IERC721Errors.ERC721NonexistentToken.selector, TOKEN_ID));
address newOnwer = nft.ownerOf(TOKEN_ID);
vm.assertTrue(newOnwer == address(0));
}

Recommended Mitigation

- function burn(uint256 _tokenId) public {
+ function burn(uint256 _tokenId) public onlyOwner {
_burn(_tokenId);
emit BidBeastsBurn(msg.sender, _tokenId);
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts ERC721: Anyone Can Burn

In the BidBeasts ERC721 implementation, the burn function is publicly accessible, allowing any external user to burn NFTs they do not own. This exposes all tokens to unauthorized destruction and results in permanent asset loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!