Comments (4)
_transfer is a private function so it cannot be overridden or called if a contracts inherits from NFToken contract... If anyone is modifying NFToken as it is he can change anything anyway..
from erc721.
Here is my reasoning and possible bug scenarios (all of them dealing with user doing something wrong):
- User inherits and overrides
safeTransferFrom
w/o adding modifiers -> open acess. - User inherits and adds its own
specialTransfer
which uses_transfer
. Here he has to explicitly check for state change permissions which happen in_transfer
. If he fails to do it, then we have open access again. - User modifies our existing implementation and does some stupid things like changing _transfer to external or other weird things.
I'm not saying this would "guard" against all stupidity but I think it's a good design if you keep permission checks coupled with the code that does states changes. Wdyt? I don't see any drawbacks but potentially we shrink surface for introducing some bugs.
from erc721.
If a user overriders safeTransferFrom he cannot call _transfer from it because it is private.. So neither 1 or 2 can happen and there is no protection for 3.
from erc721.
You're right. Just checked the docs and private functions aren't visible to derived contracts - my bad. OK, this invalidates the 1 and 2 which were the most significant ones. Closing this issue.
from erc721.
Related Issues (20)
- Support latest Solidity
- Update list of supported Node.js versions
- import nf-token-metadata.sol and ownable.sol in the remix. But it says ‘not found’ HOT 1
- Support Solidity 0.8.4
- NatSpec style: use @notice before @dev HOT 1
- 721
- Warning: SPDX license identifier not provided in source file HOT 2
- Release new npm version HOT 1
- Created NFT has no creator HOT 4
- Not an issue just need some advice! HOT 8
- Help in displaying all minted tokens HOT 8
- Question about error constants HOT 2
- Make metadata tokenURI overridable. HOT 1
- Fix dependency status icon
- Update branding HOT 1
- Cannot find json under "@nibbstack/erc721/build/" HOT 4
- Cheaper ERC-165 implementation HOT 2
- No need for assembly for code hash
- What is the meaning behind the error constants?
- Metadata extension JSON schema
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from erc721.