Skip to content
Request an audit

‹ Findings database

deTokenize() is missing access control, anyone can burn other people's nfts

Crit/HighMetaZero Omnichain NFTs audit·Three Sigma·Omnichain RWA tokenisation·27th January, 20243S-MetaZero-C02

Description

deTokenize() allows users to burn their nfts with a certain string url. The function is missing access control, such that anyone can burn any nft, POC here.

Recommendation

Either place the onlyOwner modifier or call _isApprovedOrOwner().

Status

Addressed in 5b68968.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests