Guard doesn't check for `burn(uint256)` function selector in ERC721 tokens allowing an attacker to burn NFTs after renting and utilizing them for some time.
Audit: 2024-01-renft-findings
Severity: MEDIUM

# Lines of code

https://github.com/re-nft/smart-contracts/blob/3ddd32455a849c3c6dc3c3aad7a33a6c9b44c291/src/policies/Guard.sol#L195


# Vulnerability details

### Pre-requisite knowledge & an overview of the features in question
---

1. **Gnosis safe guards**: A gnosis guard is a contract that acts as a transaction guard which allows the owner of the safe to limit the contracts and functions that may be called by the multisig owners of the safe. ReNFT has created it's own gnosis guard contract, which is [Guard.sol](https://github.com/re-nft/smart-contracts/blob/main/src/policies/Guard.sol).

    **Example**: When you ask reNFT to create a rental safe for you by calling [deployRentalSafe()](https://github.com/re-nft/smart-contracts/blob/3ddd32455a849c3c6dc3c3aad7a33a6c9b44c291/src/policies/Factory.sol#L138) in [Factory.sol](https://github.com/re-nft/smart-contracts/blob/main/src/policies/Factory.sol), reNFT creates a rental safe for you and automatically installs it's own guard contract on it. Everytime you send a call from your gnosis safe, this call has to first pass through that guard. If you're for example, trying to move a NFT token you rented using `transferFrom()`, it'll prevent you from doing so. When it intercepts the transaction you're trying to send, it checks for a [list of function signatures](https://github.com/re-nft/smart-contracts/blob/3ddd32455a849c3c6dc3c3aad7a33a6c9b44c291/src/policies/Guard.sol#L195) that can be malicious, for example it checks if you're trying to enable/disable a module it has not authorized. It checks if you're trying to change the guard contract address itself, It also checks if you're trying to transfer or approve a rented NFT or ERC1155 token using the most common functions like `approve()`, `safeTransferFrom()`, `transferFrom()`, `setApprovalForAll()`. This guard acts as the single and most important defense line against rented ERC721/1155 token theft.


---
### The Vulnerability & Exploitation Steps

---

The vulnerability exists in the [Guard.sol](https://github.com/re-nft/smart-contracts/blob/3ddd32455a849c3c6dc3c3aad7a33a6c9b44c291/src/policies/Guard.sol) contract. While the guard checks for a comprehensive list of potentially malicious function selectors such as `transferFrom`, `safeTransferFrom`, it does not check for the `burn(uint256)` function selector which exists in a wide variety of NFTs including the most popular ones. You can find an example of the `burn(uint256)` function in Openzeppelin's [ERC721Burnable.sol](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC721/extensions/ERC721Burnable.sol) ERC721 extension

This allows a malicious borrower to burn the token after using it for some time and before the rental ends by a small margin of time. This leads to permanent NFT loss for the lender, and he (the lender), won't be able to get the rental funds he deserved to get as a result of lending the borrower.

**Proof of concept**
1. Attacker rents an NFT of