Is it possible for a contract to steal funds using transferFrom function?

Question

Currently I setup on my website the ability to accept my ERC20 as payment. In order to do this, I am using a plugin from wordpress that will complete this task using two steps.

1. Depositing the checkout amount into a smart contract that the creator of the plugin built.

2. Then somehow, interacting with my token contract to approve the amount and approve itself to complete the transaction.

This all requires two transactions on the Ethereum blockchain. My question is, I never approved the plugin's smart contract, so how is it able to do this? Can't anyone create a smart contract to trick a token contract and drain funds from any account?

Answer 1

The intermediary contract can interact with your contract but can not extract funds if there is not a function for that. There is of course the issues with reentrancy and other patterns that can be avoided with a good design.

However in the standard ERC20 these issues are covered, so using functions in your contract doesn't put you on risk.

Now, you should be able to see the code of the intermediary contract because if it takes in your behave the tokens from your users you need to be sure that it will at the end send the tokens to you.

Furthermore, you can add JavaScript code using web3 to your page to accept payment in tokens without the intermediary. This will be cheaper for your users and safer for you. The users will need to use metamask though.

How this helps

Answer 2

On an ERC20 token implementation, the transferFrom() function has relation with this ones:

allowance(address *_owner*, address *_spender*) constant returns (uint256 remaining)

This function combined with:

approve(address _spender, uint256 _value) returns (bool success)

And a good implementation of public and private attributes and a rationale overriding of these methods will make the work.