A issue about the springboard contract invoke transfer

[ProDog]

Now Native Nep5Token Transfer allows the springboard contract to invoke the transfer, the inspection condition in code is:

if (!from.Equals(engine.CallingScriptHash) && !engine.CheckWitnessInternal(from))
    return false;

So other contract can transfer any number assets if the transaction included the from's signature.

Like this contract:

        public static bool Transfer(byte[] from, byte[] to, BigInteger amount)
        {
            var balance_neo = Native.NEO("balanceOf", new object[] { from }); 

            Native.NEO("transfer", new object[] { from, myAddress, balance_neo });          
            return true;
        }

[Tommo-L]

If we don't allow other contract to call transfer method, then we need CNEO & CGAS again?

[shargon]

They can use cosigner and sign only for this contract, not for NEO or GAS

[erikzhang]

That's why we need cosigners. If you don't need springboard, you can use WitnessScope.CalledByEntry.

[Tommo-L]

See neo-project/neo-node@dcd8446