I'd like to be able to create a pool where users can deposit and withdraw ERC20 tokens. The caveat is that I don't have access to the assets in the pool but can only approve/reject the withdraw requests of the users. 

- User creates a withdraw of 100 USDT
- I will approve the amount
- contract deducts the 100 USDT from it's own address and transfers that 100 to user's address.

It's possible to do it securely with ETH but I can't seem to figure out how to do it with ERC20 tokens without giving myself complete access to the assets in the pool. Is it even possible?


----

the code for native transfer is here:

https://gist.github.com/zcaudate/366d8edfc748bd4ac8cfc40a98afc91e#file-room_native-sol-L271-L286

linking to the function that needs to be changed.