# Missing token id ownership check

Entrypoint takes an id and acts on it without verifying caller owns or is approved for that id

_Area: Smart contract access control and control flow. Seen in 43 disclosed reports; latest 2025-03-20. Updated 2026-10-23._

## How it works
A function accepts an id (token, order, position, node) as a parameter and acts on it, but never confirms the caller owns or is authorized for that id. The code checks a status flag, an approval on the id, or a state-machine transition and treats that as sufficient. The broken assumption: "the id is valid and in the right state" implies "the caller is entitled to act on it." When ids are predictable, reusable, or shared across owners, anyone can name someone else's id and the function proceeds. This is distinct from generic reentrancy or state-machine bugs: the flaw is a missing authorization binding between caller and id, not a missing existence check or a reordered transition.

## Where it shows up
- Public functions taking `tokenId`, `orderId`, `gtId`, `nodeID`, or `_cidNFTID` with no `ownerOf(id) == msg.sender` or approval check.
- Public wrappers around internal ERC721 `_burn`/`_update` that skip `_isAuthorized` [E7](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.1.1.md).
- Create/register functions that double as update paths keyed by a user-supplied id, re-deriving owner from `msg.sender` [E4](https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AH-04.md).
- Routers granted operator rights over position NFTs, with entrypoints that accept the id as a parameter [E6](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.1.1.md).
- Ids recycled after deletion while stale foreign-key references persist [E1](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-02.md).
- Batch functions where an id that should be implicit (the just-minted token) is caller-supplied and unbound [E3](https://bugbountylibrary.com/r/c4%3A2023-01-canto-identity%3AH-01.md).
- Adjacent shapes: contracts allowed to be their own owner, bypassing owner checks [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-1.md); access-control mappings keyed owner=>resource instead of resource=>owner [E8](https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-04.md).

## How to review
For every entrypoint that accepts an id, trace whether the caller's authority over that id is established before any state change or asset movement. Invariant: before acting on id X, the contract must verify `msg.sender` is the current owner or an approved operator of X, checked at use time, not at creation time. Existence/identity validation is separate from ownership — a valid, live id still needs the caller-binding check. Confirm the check reads live ownership, not a cached or status-only field: a stored `nft.shortOrderId` whose order was cancelled and the id reused still passes a status check but no longer belongs to the owner [E1](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-02.md). For create-or-update functions, confirm the update branch re-validates ownership rather than overwriting it [E4](https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AH-04.md). For routers/operator approvals, check every entrypoint taking the id as a parameter for an explicit owner==msg.sender check, since the router's operator grant lets it act on any approved position [E6](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.1.1.md). For mappings, confirm key direction matches the authorization query [E8](https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-04.md).

## Variants seen
- Stale `shortOrderId` reused after cancellation, cancelling a victim's order [E1](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-02.md).
- Self-ownership plus flash action lets creditor move collateral out of accounting [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-1.md).
- Frontrun mint+add: caller-supplied id unbound to freshly minted token [E3](https://bugbountylibrary.com/r/c4%3A2023-01-canto-identity%3AH-01.md).
- Minipool create overwrites owner via reused nodeID [E4](https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AH-04.md).
- Router borrows against victim's gtId after frontrunning approval [E6](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.1.1.md).
- Public burn wrapper without owner check [E7](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.1.1.md).
- Owner=>resource mapping direction authorizes wrong caller [E8](https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-04.md).

## Impact and severity
Led to cancellation of others' orders [E1](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-02.md), uncollateralized loans [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-1.md), loss of staked funds [E4](https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AH-04.md), stolen debt tokens [E6](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.1.1.md), and blocked fee withdrawal [E7](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.1.1.md). Severity is high where the id gates asset movement; worse when ids are predictable or reusable and a single call moves value irreversibly.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-02.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-1.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-01-canto-identity%3AH-01.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AH-04.md
- E5: https://bugbountylibrary.com/r/c4%3A2022-11-ens%3AH-01.md
- E6: https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.1.1.md
- E7: https://bugbountylibrary.com/r/cantina%3Asilo%3A3.1.1.md
- E8: https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-04.md