# Sandbox LAND: public _burn lets anyone destroy victim NFTs

Sandbox LAND's public _burn let anyone burn any user's NFTs, destroying 100 of a victim's 2762 LAND tokens.

- Payout: Real-world hack
- Severity: high
- Program: Sandbox LAND
- Analysis by: DeFiHackLabs
- Disclosed: 2022-02-08
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-02/Sandbox_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220208-sandbox
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** LAND ERC-721 contract _burn function
**Root cause:** The _burn function was left externally callable with attacker-controlled owner/from parameters, so any address could burn NFTs held by any other address.
**Steps:**
1. Fork mainnet at block 14163041
2. Prank as arbitrary attacker 0x6FB0B915D0e10c3B2ae42a5DD879c3D995377A2C
3. Call `Land._burn(victim, victim, 3738)` with victim 0x9cfA73B8d300Ec5Bf204e4de4A58e5ee6B7dC93C
4. Repeat in a loop to burn many tokenIds from the victim
**How found:** Recognized that _burn was exposed as a public state-changing function accepting arbitrary owner/from, enabling unauthorized destruction of others' NFTs.
**Exploitation:** Attacker calls the publicly exposed _burn with the victim as owner/from and a tokenId, destroying the victim's LAND NFTs without any approval or ownership.
**Insight:** On NFT contracts, check whether internal burn/transfer helpers are accidentally exposed externally and accept caller-supplied owner/from, letting anyone destroy or move others' tokens.