When someone sends Ether, he/she use his private key matching address to sign the transaction. The private key not being part of the ledger, nobody can draw the fund of the account which sent money.
But how does this works for a smart contract since (as far I understand) a smart contract doesn’t have a private key ?
This not for asking how the CALL opcode works, but how internal transactions which sends Ether are handled in the ledger.
Every transaction that has ever occurred was first initiated externally from a regular or external account. If that transaction is to another external account, then the transaction is finished.
If that transaction is to a smart contract account, then further interactions (either sending ether and calling into other smart contracts) is possible.
The smart contracts themselves never initiate transactions. This is why it's so important to demand of the developers to publish their source code. The word "contract" implies that if you initiate a transaction from the outside, it will do exactly what you've told it to do.
The contract does not sign transactions. Remember that the execution of a contract is triggered by an externally owned account. That external account is who signs the transaction that will be executed by the contract, even when the contract calls another contract, this is just a part of the same transaction.
Hope this helps
