I've been trying to learn about smart contracts. After taking a look at the source code for the erc-721 standard, the transfer function has me confused enter image description here

The "to" and "from" arguments are public wallet addresses correct? What's stopping anyone from passing in any two public wallets and stealing tokens. Im assuming the private key is used, but where and how? Is the private key passed in somewhere else? Is it passed in along with the public address? Help is greatly appreciated!

1 Answer 1


You have to be approved to spend tokens from another persons wallet. Aka they have to send an approve call to the contract to approve your address to spend on their behalf. Hence,

require(_isApprovedOrOwner(msg.sender, tokenId));

Checks to make sure you are the from address, or the from address has approved you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.