Insufficient validation checks in ` burnOrSwapExternalToMint() ` function  allows callers to swap/burn another account's NFTs without proper prior delegation.
Audit: 2023-10-nextgen-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/MinterContract.sol#L331-L338


# Vulnerability details

## Impact

Absence of proper delegation checks in the ` burnOrSwapExternalToMint() ` function, 
enables a caller to perform burn/swap actions without proper authorizations over both collections.

## Proof of Concept

Contract : ` NextGenMinterContract `

As per to the NFT Delegation docs (https://github.com/6529-Collections/nftdelegation)

Use case '1' =	All Rights
Use case '2' =	Minting / Allowlist Rights

` burnOrSwapExternalToMint() ` function does the following checks before allowing the caller to burn/swap 
collection `A` ( `_erc721Collection` ) for a new collection 'B' (NextGen Collection). 

```

if (msg.sender != ownerOfToken) {
            bool isAllowedToMint;
            isAllowedToMint = dmc.retrieveGlobalStatusOfDelegation(ownerOfToken, 
                               0x8888888888888888888888888888888888888888, msg.sender, 1) || 
                              dmc.retrieveGlobalStatusOfDelegation(ownerOfToken, 
                              0x8888888888888888888888888888888888888888, msg.sender, 2);   
 
            if (isAllowedToMint == false) {
            isAllowedToMint = dmc.retrieveGlobalStatusOfDelegation(ownerOfToken, _erc721Collection, 
                              msg.sender,1) || 

                              dmc.retrieveGlobalStatusOfDelegation(ownerOfToken, _erc721Collection, 
                              msg.sender, 2);                                 
            }

            require(isAllowedToMint == true, "No delegation");
        }

```

Alice = Delegator = Owner of the ' _burnCollectionID ' from external NFT address ` _erc721Collection ` 
Bob = caller 

Assume 

Scenario 1:
a) Alice has delegated Bob's address, with the rights to mint new 'NextGen' collections. (use case 2)
But
b) Alice provided only the minting rights to Bob, for external collection `_erc721Collection` (use case 2)
(which means No rights to transfer / burn )

Scenario 2:
a) Alice has delegated Bob's address, with the rights to mint new 'NextGen' collections. (use case 2)
But
b) Alice did NOT provide any delegation rights to bob -- with respect to (w.r.t) her external NFT collection `_erc721Collection` 

Scenario 3:
a) Alice did NOT delegate Bob for any tasks w.r.t the 'NextGen' collections.
But
b) Alice provided minting rights to bob -- w.r.t her external NFT collection `_erc721Collection` (use case 2)


Notice that in all scenarios, 

The caller (Bob) should NOT be permitted to swap/burn the external collection `_erc721Collection` 
as bob does NOT have the delegation rights to perform such actions, 
with respect to the owner of the ' _burnCollectionID '.

But currently the ` require(isAllowedToMint == true, "No delegation") ` check can be passed 
if the caller has minting rights for any of the two collections.

This is not acceptable.

## Tools Used

Manual Review.

## Recommended Mitigation Steps