隐僵尸transferFrom函数

Question

如果函数transferFrom由_tokenId的所有者调用，但具有与msg.sender不同的_from参数，则会发生什么情况？msg.sender ()不是检查_from是否等于_from，所以我可以将任何地址传递给_from，并扰乱ownerZombieCount映射并发出错误的传输事件。

我没观察到什么吗？

pragma solidity >=0.5.0 <0.6.0;

import "./zombieattack.sol";
import "./erc721.sol";

contract ZombieOwnership is ZombieAttack, ERC721 {

  mapping (uint => address) zombieApprovals;

  function balanceOf(address _owner) external view returns (uint256) {
    return ownerZombieCount[_owner];
  }

  function ownerOf(uint256 _tokenId) external view returns (address) {
    return zombieToOwner[_tokenId];
  }

  function _transfer(address _from, address _to, uint256 _tokenId) private {
    ownerZombieCount[_to]++;
    ownerZombieCount[_from]--;
    zombieToOwner[_tokenId] = _to;
    emit Transfer(_from, _to, _tokenId);
  }

  function transferFrom(address _from, address _to, uint256 _tokenId) external payable {
    require (zombieToOwner[_tokenId] == msg.sender || zombieApprovals[_tokenId] == msg.sender);
    _transfer(_from, _to, _tokenId);
  }

  function approve(address _approved, uint256 _tokenId) external payable onlyOwnerOf(_tokenId) {
    zombieApprovals[_tokenId] = _approved;
    emit Approval(msg.sender, _approved, _tokenId);
  }
}

编辑:我刚刚检查了from 721索尔

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC721/ERC721.sol

还有require(ERC721.ownerOf(tokenId) == from, "ERC721: transfer from incorrect owner");检查，所以我想密码僵尸的实现仅仅是为了教育目的，并且缺乏安全性，并且有可能妥协。

Answer 1

是的，本合同仅用于教育目的。

但是，如果msg.sender是tokenId的所有者，则可以使用require

require(ownerOf(tokenId) == from, "Transfer from incorrect owner");