Reject TransferOwnership Smart Contract Solidity

Question

I found the following code for solidity smart contracts ownership purposes.

contract owned {
    address public owner;

    function owned() public {
        owner = msg.sender;
    }

    modifier onlyOwner {
        require(msg.sender == owner);
        _;
    }

    function transferOwnership(address newOwner) onlyOwner public {
        owner = newOwner;
    }
}

I would like to know if it is possible to reject ownership of a contract which is transferred by owner of that contract to your contract address(or your EOA)

The reason I'm asking this question is to prevent the following scenario

• Bob is owner of contract C1 and Alice is owner of contract C2
• Contract C1 can automatically withdraw ether(generally any token)from it's owner address and send it to Bob's EOA. In other words it is malicious contract at all which can do bad things
• Bob calls the function transferOwnership of contract C1 and transfer the Ownership to either contract C2 address or Alice's EOA .
• Contract C2 or Alice becomes the owner of contract C1
• Contract C1 start to withdraw the balance of it's newowner = Contract C2 or Alice, and send it to Bob's EOA

Answer 1

It is not possible for an address to refuse being used as the owner in another contract.

Moreover, the "attack" you described will not work, as a contract is not able to magically take ether or tokens from another contract or externally owned account.

In the case of ether, a contract can never take ether from an externally owned account, unless the account transfers ether to the contract (which requires a regular transaction). In the event of another contract, a contract may only withdraw ether from another one if the second contract exposes a function or some method to do so. In a well written contract, this method would be safeguarded against random addresses invoking it.

For tokens, the approve function within ERC20 (or equivalent functions in other implementations) must be used to authorise an address to withdraw from the balance of another. As long as this has not been called by Alice, Bob cannot simply set Alice as the owner of a contract, and have that contract start withdrawing Alice's tokens.

Answer 2

Any Smart Contract can't automatically withdraw ETHER from EOA of user. Because Contract functions need to get transaction signed from user's EOA, otherwise that transaction will not be valid in network. So anybody can't stop making him owner of any contract but there are not any api that lets smart contract to withdraw ether from anybody's EOA account.