My smart contract holds some USDT token and now if someone knows my Contract address can he/she transfer that USDT to his/her address.
I wanted to know that whether USDT contract have any check related to that?
Only if your contract:
- Exposes a function for withdrawing that USDT
- That function has no access-restriction (can be called by anyone)
Other than that, it is rather difficult to answer your question without seeing your contract's code.
it has nothing to do with my contract, the USDT contract has a function transferFrom(from_add,to_add,val)
in this function the money transfer from from_add to to_add
now consider the from_add is my contract that holds the 5USDT and to_add is someone who knows the from_add
this is the code for DAI similar to USDT
how can i protect it and also the balance get stored in DAI or USDT contract
The only way for some_addr to execute this transaction, is if from_addr first executes:
USDT_Contract.approve(some_addr, val_or_higher)`
Assuming that you are the only one who knows the private key of from_addr, and that you haven't executed the transaction above, the tokens ascribed to from_addr are safe.
smart contract does not have a private key, contract is a public address then how?
The answer doesn't change much even If from_addr is the address of a contract.
The only way for some_addr to execute USDT_Contract.transferFrom(from_addr, to_addr, val)
is if the contract deployed at address from_addr implements a function which executes:
USDT_Contract.approve(some_addr, val_or_higher)
And someone has executed that function.