In @openZeppelin's ERC20 implementation here is the code for function transferFrom
:
function transferFrom(address sender, address recipient, uint256 amount) public virtual override returns (bool) {
_transfer(sender, recipient, amount);
_approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "ERC20: transfer amount exceeds allowance"));
return true;
}
function _transfer(address sender, address recipient, uint256 amount) internal virtual {
require(sender != address(0), "ERC20: transfer from the zero address");
require(recipient != address(0), "ERC20: transfer to the zero address");
_beforeTokenTransfer(sender, recipient, amount);
_balances[sender] = _balances[sender].sub(amount, "ERC20: transfer amount exceeds balance");
_balances[recipient] = _balances[recipient].add(amount);
emit Transfer(sender, recipient, amount);
}
The amount
is reduced from the balance of sender
and added to the balance of recipient
. Also the caller's allowance from sender
is reduced by amount
. The implementation puzzles me in that there is no sender
and recipient
verification and that means sender
and recipient
can be any 2 arbitrary addresses. What if the sender
and caller msg.sender
are not the same address? What is the use case for transferFrom
?