Root + Impact

Description

Ìn a normal flow, The burn function should only allow token owners or approved operators to burn their tokens, following the standard ERC721 security model.

But the current implementation allows any address to burn any token ID without proper authorization checks, enabling malicious actors to destroy other users' NFTs.

Risk

The Risk is High beacause:

• Anyone can call the burn function with any valid token ID, IF the NFT is bidding, attacker can burn the NFT and make the bid fail.

Likelihood:

• The Likelihood is High:

because

• Any external user can call the burn function with any valid token ID without restrictions

• The function is public and contains no access control mechanisms beyond OpenZeppelin's internal _burn validation

Impact:

• Complete loss of user NFTs as tokens can be permanently destroyed by malicious actors

• Violation of user trust and token ownership principles, potentially making the contract unusable

Proof of Concept

Here's a simple example of how an attacker could exploit this vulnerability:

The vulnerability allows an attacker to burn any user's NFT without their permission, leading to permanent loss of the token.
AND this vulnerability is obvious to exploit，attacker just need to call the burn function with the victim's token ID so that the token is permanently destroyed.

Recommended Mitigation

• Add Access Control: Restrict the burn function to only allow the token owner or an approved operator to call it. This can be done by adding a modifier that checks if msg.sender is the owner of the token or is approved.

• OpenZeppelin's Ownable or AccessControl can be used to manage permissions effectively.