Submitted by Kenshin
CryptoPunksHelper.sol#L38
CryptoPunksHelper.sol#L52
In the NFT helper contract, there is no validation on that the receiver address must not be address zero. Therefore, it allows owner or an attacker who gain access to the owner address to burn NFTs forever through the functions by transferring the NFTs to address zero.
The PoC is originally conducted using foundry. However, it isnt that complicated so I rewrote it in TypeScipt as well, the team can easily proof this by including in the CryptoPunksHelper.ts.
foundry.toml
Even the functions are restricted for only the owner, the zero address should not be allowed as the receiver address.
spaghettieth (JPEGd) acknowledged and commented:
