Token contract security issue

Question

Accordin to this article valid ERC20 token must implements number of methods. Among then these two:

function transferFrom(address _from, address _to, uint _value) returns (bool success);
function approve(address _spender, uint _value) returns (bool success);

ERC20 standard does not declares any security advice so, anybody who has contract address, contract ABI and know non-empty address can approve any number of tokens and then - transfer it to any other account?

Answer 1

The approve function allows any address to approve a spender to spend coins from their own account (msg.sender).

The transferFrom function only allows any approved spender to spend the approved amount.

This is not a security concern because only the owner of the tokens can approve only their own tokens and only the approved spender can spend.

I suggest looking at a common ERC20 implementation like the one from Consensys.