search

Zilliqa / ZRC

Zilliqa Reference Contracts
MIT License
40 stars 57 forks source link

fix(zrc1): only token owner can add an operator #111

Closed ghost closed 2 years ago

ghost commented 2 years ago

This PR makes only token owners be the _sender for SetApprovalForAll(). If some random user, who doesn't own any token, tries to add an operator it will throw CodeNotTokenOwner.

Currently, anyone who doesn't have any token can set anyone as an operator with SetApprovalForAll() and create some garbage data in the contract. Only token owners should be able to add an operator.