CheckWitness does not pass using RegisterAppCall about neo-boa

[deanpress]

Wouldn't passing this open up to security risks? e.g. a malicious smart contract (Contract A) calling do_transfer on Contract B without the user's knowledge. In this case Contract B should register manual approval for Contract A to make invocations on the user's behalf first, which brings us to NEP-5.1 approve() and transferFrom().

[chris-poli]

I haven't looked at this for awhile and very well may have misunderstood but i was hoping at the time, Contract A, would just be able to trigger do_transfer, meaning it could be easily proven a smart contract is the one calling an operation on its own behalf. To give specific context and ignoring the larger scope, for a withdrawal, the smart contract would be able to send its own funds to another address by getting its script hash and calling this method.

As you said though, NEP-5.1 is solving some of these issues, it sounds like a great proposal!

[deanpress]

@chris-poli I see, that makes sense. This issue proposes the ability for smart contracts to send their own funds by adjusting how CheckWitness works.
I have a NEP for programmable tokens, perhaps we can discuss some extensions that help with the issue you described as well; neo-project/proposals#64