Can a 3rd party smart contract transfer user funds without approval by using delegatecall('transfer', to, amount)?

Question

I'm creating a contract where the user would transfer X amounts of tokens A and B to my smart contract for a task. The problem with this is that in principle, the user would have to sign and send 3 transactions: 2 for approvals of the tokens, and then 1 more for the smart contract that it would call transferFrom(user, address(this), amount). To improve user experience, would it be possible instead to have the user call the function:

function transferFromUser(address token, uint256 value) {
    // 0xa9059cbb = transfer function selector
    (bool success, bytes memory data) = token.delegatecall(abi.encodeWithSelector(0xa9059cbb, address(this), value));
}

This way the context when calling transfer via delegatecall would mark the user address as msg.sender and hence it should work without the need for approval right? The token smart contract would think that the user itself is calling that function so there would be no need to sign on the approval. Is this correct?

There is a similar question being asked here Transfer ERC20 via onother smart contract (call transfer as delegate) but I opened this one because I don't entirely agree with the answer marked as accepted. In my case, contract A is my smart contract and contrat B is the token's contract. If user calls contractA, which calls contractB's transfer() function with delegatecall(), it would be as if the user calls transfer() themselves right?

Answer 1

From my understanding, that wouldn't do the job since you are using the storage of contractA (your contract) but not modifying contractB's storage.

ex: https://solidity-by-example.org/delegatecall/

Therefore you wouldn't be transferring the tokens of contractB but a copy of contractB's tokens. And that even implying that the address you're sending from has the appropriate token balance on contractA.

If you want to be transferring tokens of contractB you'd have to use call().

If you wanted to make a copy of contractB's storage you could use staticcall() on the contractB's balanceOf([userAddress]), and assign the encoded return value to balanceOf[userAddress] to contract A. And for that you'd need to have the same state variables of contractB declared in contractA (in the same order!).

And FINALLY, be it on your contract or any for that matters, you cannot transfer tokens from an address ifyou are not that address nor approved by that address.