1

Is it possible to call a ERC721 transfer function when you are not the Owner? Am pretty new to solidity so if you can plz provide your code so I can understand well. (BTW had asked question before but I was a bit confuse by he/her answer) here my code again:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "@openzeppelin/contracts/token/ERC721/ERC721.sol";
import "@openzeppelin/contracts/utils/Counters.sol";

contract Tink is ERC721 {
    using Counters for Counters.Counter;
    Counters.Counter private _tokenIdCounter;

    constructor() ERC721("Tink", "TNT") { 

    }

    function _baseURI() internal pure override returns (string memory) {
        return "https://gateway.pinata.cloud/ipfs/QmX8ih22uNW5cDH5CeorzpTHTbsioFurgD6w5q7RKt298H";
    }


    function mint(address to)
        public returns (uint256)
    {
        require(_tokenIdCounter.current() < 3); 
        _tokenIdCounter.increment();
        _safeMint(to, _tokenIdCounter.current());

        return _tokenIdCounter.current();
    }
}
13
  • ERC721 has no "transfer" function. it has "TransferFrom(sender, receiver, tokenId)" if you are using the openzeppelin contracts (without any change) then only the owner or approver can transfer the tokens. if someone else tries then it will revert. btw, in your contract everyone can call mint(..)
    – Majd TL
    Nov 16, 2021 at 10:14
  • @MajdTL but if anyone can call the mint function how will they send ether to my account?
    – GGK1000
    Nov 16, 2021 at 11:56
  • they don't need to send you ether, that is not in your code! you are just limiting the number of nfts to total of 3 and they will just call the mint function. Anyway, the question is not about mint. It is about transfer and only the owner and approver can call transfer (it is the expected behavior) unless you change the code
    – Majd TL
    Nov 16, 2021 at 12:20
  • @MajdTL Then how do call a transferFrom function without being the owner?
    – GGK1000
    Nov 16, 2021 at 13:16
  • I need to understand why you want to call transferFrom without being the owner of the Id?
    – Majd TL
    Nov 16, 2021 at 14:11

2 Answers 2

1

Yes, anybody can call the transfer functions (transferFrom and both flavors of safeTransferFrom). But typically the functions will throw if they are not authorized.

Here are the scenarios which typically will result in a successful transfer:

  1. Owner of the token is calling the transfer
  2. That specific token is approved to somebody else that is transferring
  3. Owner of the token does "authorize for all" to somebody else that is transferring
  4. Contract has "backdoored" other accessors for tokens
5
  • How do I authorize my contract for Anyone that call the transfer function? thanks in advance.
    – GGK1000
    Nov 17, 2021 at 3:25
  • You are able to customize the transferFrom and safeTransferFrom functions to add your own authentication. Nov 18, 2021 at 14:47
  • How? more specifically
    – GGK1000
    Nov 19, 2021 at 4:04
  • By creating an overriding function. Anything more specific than that, of course, requires details about the application's requirements Nov 20, 2021 at 22:20
  • So your saying that I have to override my function? also I read another question here ethereum.stackexchange.com/questions/98692/… you have to approve from outside of the contract like web3 right? (btw if you can plz provide code as explanation)
    – GGK1000
    Nov 23, 2021 at 6:34
0

Yes, literally everybody can call any function in your contract. To restrict this behaviour, you should make the contract Ownable.

https://docs.openzeppelin.com/contracts/2.x/api/ownership

1
  • As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Nov 17, 2021 at 0:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.