# deTokenize() is missing access control, anyone can burn other people's nfts Crit/High · Three Sigma · Omnichain RWA tokenisation · 27th January, 2024 Finding 3S-MetaZero-C02 of the MetaZero Omnichain NFTs security review. - Protocol: https://metazero.gg/ - Report: /reports/metazero-i - Source: https://cdn.sanity.io/files/qoqld077/production/1b1ab4ff365756fe1d86767f1e06744407570f5a.pdf --- ### Description [deTokenize()](https://github.com/threesigmaxyz/metazero-issues-external/blob/master/src/ONFTV2-721C.sol#L85) allows users to burn their nfts with a certain string url. The function is missing access control, such that anyone can burn any nft, POC [here](https://github.com/threesigmaxyz/metazero-issues-external/blob/master/test/test.t.sol#L46). ### Recommendation Either place the onlyOwner modifier or call _isApprovedOrOwner(). ### Status Addressed in 5b68968. --- Related findings: - [Throughout code-base: Homogenize how access control is done.](https://0xsimao.com/findings/maple-finance-iii-homogenize-access-control-done): Maple Finance - [SpiritVestingFactory::setTreasury() could be 2 factor, as well as the AccessControl OZ contract used in the codebase](https://0xsimao.com/findings/spirit-protocol-vesting-well-access-control): Spirit Protocol - [`ManagedLeveragedVault.sol::deposit()` is missing slippage control](https://0xsimao.com/findings/beraborrow-i-sol-deposit-slippage-control): Beraborrow Managed Dens - [Anyone can get the NFT collateral token after an Auction without bidding due to missing check on msg.sender](https://0xsimao.com/findings/benddao-nft-collateral-auction-bidding): BendDAO