Cryptoninja World NFT hack Analysis — Improper Access control

Overview:

On February 22, 2023, a breach took place that led to improper authentication and access control checks on the burn function, which was externally callable, allowing tokens to be burned directly by any external users on CryptoNinjaWorld’s Contract. This vulnerability was being detected in our tool SolidityScan which is a cloud-based smart contract security scanner.

Smart Contract Hack Overview:

• Attacker’s Address: 0xc9af3a
• Attacker’s Transaction: 0xd93704f2
• Vulnerable Code: 0xd93704f2a0ea3db109de1

Executing the burn function by the attacker to burn the NFTs

Decoding the Smart Contract Vulnerability:

• It was discovered that the burn function was incorrectly constructed and had external visibility that let users or contracts call it and alter the contract, which led to the attackers burning NFT tokens.

• As can be observed from the burn function implementation, the security concepts of using modifiers and requiring conditions to validate user addresses when interacting with essential functions like burn are violated since the burn function does not check for caller validation.

Mitigation and Best Practices:

• Ensure that only authorized users can call the _burn function. One way to achieve this is to implement access control using OpenZeppelin’s AccessControl contract. This can be done by adding a require statement at the beginning of the function to check that the caller has the necessary role.
• Use modifiers to prevent anyone to interact with such functions and make sure the function is not externally callable.
• To prevent such vulnerabilities, the best Smart Contract auditors must examine the Smart Contracts for logical issues. We at CredShields provide smart contract security and end-to-end security of web applications and externally exposed networks. Schedule a call at https://credshields.com/
• Scan your Solidity contracts against the latest common security vulnerabilities with 130+ detection at SolidityScan including access control vulnerabilities.

SolidityScan — Smart Contract Vulnerability Scanner

Conclusion:

SolidityScan is an advanced smart-contract scanning tool that discovers vulnerabilities and reduces risks in code. Request a security audit with us, and we will help you secure your smart contracts. Signup for a free trial at https://solidityscan.com/signup

Follow us on our Social Media for Web3 security-related updates.
SolidityScan — LinkedIn | Twitter | Telegram | Discord