How are transfer prevented of a token?

Question

Was read through Solidity staking source codes, something left me quite puzzled.

dappToken.transfer(recipient, getUserTotalValue(recipient));

The code above is the line of code to transfer the reward tokens to the recipient. Reward token is an ERC20 token.

What got me confused is, is there any mechanism in place to prevent others from randomly dsitributed tokens for staking? How can anyone just call the transfer function?

An example will be

Person A deploys Token X. Person B uses Token X as a reward token for staking some Token Y, without Person A approval.

Surely there has got to be some mechanisms in place to prevent something like this from happening right?

Answer 1

You're right.

I'm assuming you're using the Openzeppelin rendition of the transfer function. If that's the case, the transfer function will only transfer tokens that that transaction sender holds.

So in your example, Person B wouldn't be able to transfer any tokens, since person B owns 0 of Token X.