Users could accidentally burn() and lose fund

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/enforcer/HolographERC721.sol#L387-L397
https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/enforcer/HolographERC20.sol#L337-L345

Vulnerability details

Impact

If users accidentally burn() the token, the fund will be lost. There does not seem any reason for the users to call the public burn() function, only by mistake calling the method to lose self fund.

Proof of Concept

// contracts/enforcer/HolographERC721.sol
  function burn(uint256 tokenId) external {
    require(_isApproved(msg.sender, tokenId), "ERC721: not approved sender");
    address wallet = _tokenOwner[tokenId];
    if (_isEventRegistered(HolographERC721Event.beforeBurn)) {
      require(SourceERC721().beforeBurn(wallet, tokenId));
    }
    _burn(wallet, tokenId);
    if (_isEventRegistered(HolographERC721Event.afterBurn)) {
      require(SourceERC721().afterBurn(wallet, tokenId));
    }
  }

// contracts/enforcer/HolographERC20.sol
  function burn(uint256 amount) public {
    if (_isEventRegistered(HolographERC20Event.beforeBurn)) {
      require(SourceERC20().beforeBurn(msg.sender, amount));
    }
    _burn(msg.sender, amount);
    if (_isEventRegistered(HolographERC20Event.afterBurn)) {
      require(SourceERC20().afterBurn(msg.sender, amount));
    }
  }

Tools Used

Manual analysis.

Recommended Mitigation Steps

Remove the public burn() functions in ERC721 and ERC20.

[gzeoneth]

There are a lot of way that user can accidentally burn their fund, risk is very low.

[alexanderattar]

It is the users responsibility to not burn their tokens