This question is an exact duplicate of:
Let's say I have an ETH address and that same address holds AAA, BBB and CCC tokens. Each token symbol is managed by a different contract (each contract was created by a different person/organization with different private keys). However, the same ETH address was "registered" with each contract (e.g. ICO sale/airdrop/rewards/referral/profit shares).
Can one fraudulent contract steal tokens from the other? For example, let's say the CCC contract contains malicious code that could transfer (steal) AAA and BBB tokens because the owner of the ETH address was tricked into "registering" the public ETH address with the CCC contract (scam). Is that possible or can each contract only access its own tokens?
Follow up question (if I am allowed to ask more than one question):
If it is possible, should an inexperience non-developer completely avoid all forms of contract invocations or is there a relatively easy way to determine what a contract can and cannot do with regards your other tokens/ETH?
If it is not possible (each contract can only control its own tokens), how do decentralized exchanges trade (transfer) tokens that they do not own?