Ethereum Stack Exchange is a question and answer site for users of Ethereum, the decentralized application platform and smart contract enabled blockchain. It only takes a minute to sign up.
Sign up to join this community
I've been trying to learn about smart contracts. After taking a look at the source code for the erc-721 standard, the transfer function has me confused 
The "to" and "from" arguments are public wallet addresses correct? What's stopping anyone from passing in any two public wallets and stealing tokens. Im assuming the private key is used, but where and how? Is the private key passed in somewhere else? Is it passed in along with the public address? Help is greatly appreciated!
You have to be approved to spend tokens from another persons wallet. Aka they have to send an approve call to the contract to approve your address to spend on their behalf. Hence,
require(_isApprovedOrOwner(msg.sender, tokenId));
Checks to make sure you are the from address, or the from address has approved you.
