I have a master contract (Contract A) which interacts with another contract (Contract B). Contract A has functions that use 'safeTransferFrom' to move tokens into Contract B, and there are some require statements which need to be present to ensure that only certain tokens may be moved from Contract A to Contract B.
My question is - is it secure enough to include these require statements only within Contract B's "onERC721Received" function, and not within Contract A's transfer function? Is it good practice to be redundant and include the require statements in both (transfer and receiving)?
My understanding is that onERC721Received will be called by Contract B every time "safeTransferFrom" is called from Contract A, therefore I feel this should be adequate. Just wondering if there's some edge cases that i'm unaware of where onERC721Received could get bypassed, or if this would be considered reasonably secure. I'm aware that unsafe transfers etc won't trigger it, but that's fine - all valid transfers will be via safeTransferFrom. Thanks.