# Smart contract holds USDT **URL:** \ **Category:** Smart Contracts\ **Tags:** erc20\ **Created:** [December 6, 2023, 11:20am UTC](https://forum.openzeppelin.com/t/smart-contract-holds-usdt/38728 "2023-12-06T11:20:46Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Nishant\_Dhamija](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/nishant_dhamija/32/19870_2.png) [@Nishant\_Dhamija](https://forum.openzeppelin.com/u/Nishant_Dhamija)\ **Post date:** [December 6, 2023, 11:20am UTC](https://forum.openzeppelin.com/t/smart-contract-holds-usdt/38728/1 "2023-12-06T11:20:46Z")
My smart contract holds some USDT token and now if someone knows my Contract address can he/she transfer that USDT to his/her address. I wanted to know that whether USDT contract have any check related to that? ---
**Author:** ![barakman](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/barakman/32/855_2.png) [@barakman](https://forum.openzeppelin.com/u/barakman)\ **Post date:** [December 6, 2023, 12:09pm UTC](https://forum.openzeppelin.com/t/smart-contract-holds-usdt/38728/2 "2023-12-06T12:09:37Z")
> [@Nishant\_Dhamija](#): > > f someone knows my Contract address can he/she transfer that USDT to his/her address Only if your contract: 1. Exposes a function for withdrawing that USDT 2. That function has no access-restriction (can be called by anyone) Other than that, it is rather difficult to answer your question without seeing your contract's code. ---
**Author:** ![Nishant\_Dhamija](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/nishant_dhamija/32/19870_2.png) [@Nishant\_Dhamija](https://forum.openzeppelin.com/u/Nishant_Dhamija)\ **Post date:** [December 6, 2023, 12:21pm UTC](https://forum.openzeppelin.com/t/smart-contract-holds-usdt/38728/3 "2023-12-06T12:21:24Z")
it has nothing to do with my contract, the USDT contract has a function transferFrom(from\_add,to\_add,val) in this function the money transfer from from\_add to to\_add now consider the from\_add is my contract that holds the 5USDT and to\_add is someone who knows the from\_add > **[Dai Stablecoin (DAI) Token Tracker | Etherscan](https://etherscan.io/token/0x6b175474e89094c44da98b954eedeac495271d0f#code)** > > Dai Stablecoin (DAI) Token Tracker on Etherscan shows the price of the Token $0.9969, total supply 3,674,369,913.947114065264928068, number of holders 498,667 and updated information of the token. The token tracker page also shows the analytics and... this is the code for DAI similar to USDT how can i protect it and also the balance get stored in DAI or USDT contract ---
**Author:** ![barakman](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/barakman/32/855_2.png) [@barakman](https://forum.openzeppelin.com/u/barakman)\ **Post date:** [December 6, 2023, 12:34pm UTC](https://forum.openzeppelin.com/t/smart-contract-holds-usdt/38728/4 "2023-12-06T12:34:29Z")
> [@Nishant\_Dhamija](#): > > `USDT_Contract` has a function `transferFrom(from_addr, to_addr, val)` The only way for `some_addr` to execute this transaction, is if `from_addr` first executes: ```auto USDT_Contract.approve(some_addr, val_or_higher)` ``` Assuming that you are the only one who knows the private key of `from_addr`, and that you haven't executed the transaction above, the tokens ascribed to `from_addr` are safe. ---
**Author:** ![Nishant\_Dhamija](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/nishant_dhamija/32/19870_2.png) [@Nishant\_Dhamija](https://forum.openzeppelin.com/u/Nishant_Dhamija)\ **Post date:** [December 6, 2023, 1:44pm UTC](https://forum.openzeppelin.com/t/smart-contract-holds-usdt/38728/5 "2023-12-06T13:44:51Z")
smart contract does not have a private key, contract is a public address then how? ---
**Author:** ![barakman](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/barakman/32/855_2.png) [@barakman](https://forum.openzeppelin.com/u/barakman)\ **Post date:** [December 6, 2023, 2:35pm UTC](https://forum.openzeppelin.com/t/smart-contract-holds-usdt/38728/6 "2023-12-06T14:35:32Z")
The answer doesn't change much even If `from_addr` is the address of a contract. The only way for `some_addr` to execute `USDT_Contract.transferFrom(from_addr, to_addr, val)` is if the contract deployed at address `from_addr` implements a function which executes: ```auto USDT_Contract.approve(some_addr, val_or_higher) ``` And someone has executed that function.