Require one yoctoNEAR

• Full-access keys have complete control over the account, including the ability to transfer NEAR tokens
• Function-call keys are requested by third-party apps to sign transactions on behalf of the user. They can only call methods on a specific contract and cannot transfer NEAR tokens.

​

The vulnerable pattern

pub fn nft_transfer(&mut self, receiver_id: AccountId, token_id: TokenId) {
    let sender_id = env::predecessor_account_id(); 
    self.assert_token_owner(&token_id, &sender_id);
    self.internal_transfer(&sender_id, receiver_id, token_id);
}

​

How the issue happens

1. A user gives a website a function-call
2. The website calls nft_transfer, sending the NFT to its own account without opening the user’s wallet
3. predecessor_account_id is still the user’s account, so the ownership check passes
4. The contract transfers the NFT even though the user did not confirm this particular transfer

​

The safe pattern

#[payable]
pub fn nft_transfer(&mut self, receiver_id: AccountId, token_id: TokenId) {
    assert_one_yocto();

    let sender_id = env::predecessor_account_id();
    self.assert_token_owner(&token_id, &sender_id);
    self.internal_transfer(&sender_id, receiver_id, token_id);
}