Imagine A gives permission to B to transfer tokenId==111. That is, _tokenApprovals[111]=B. B executes transferFrom and sends the token to himself. Later, through some exchange for example, B sells the token 111 to another person, without having modified _tokenApprovals[111]. Couldn't he send the token to himself again, because _tokenApprovals[111] is still equal to B?

1 Answer 1


That's exactly why in the transfer() method they clear approvals. Which does reset _tokenApprovals.


  // Clear approvals from the previous owner
  _approve(address(0), tokenId);
  • 2
    thanks man! somehow I missed that part of the code
    – queequeg
    Apr 5, 2022 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.