My smart contract holds some USDT token and now if someone knows my Contract address can he/she transfer that USDT to his/her address.

Just to clarify the USDT contract has transferfrom function which transfer money from one address to another

3 Answers 3


If your the transfer method doesn't have any access restriction most probabaly the answer is YES, he/she can transfer that USDT. If you want to prevent such malicious activities I recommend you to check this page of the OpenZeppelin's documentation


It depends on your contract code. If the contract calls token.transfer, or token.transferFrom it is possible. You would need to check if the parameters to those calls are manipulable.

More generically if your contract can call an arbitrary contract, or delegatecall a contract it might be possible.


I think it depends on your contract code of couse, there are variety use of this function like in the uniswap 1inch swap and liquidity mining

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.