ERC20 contract security - solidity

Question

i try to create a withdraw function call by external, and i have a problem with erc20, when you look stoler function, i imagine somebody who create a contract with a contructor of on existing ERC20 and after he can take every token of the contract no? I hope no but when i try this each address can take Mytoken
Mytoken yourToken;
constructor(address tokenAddress) {
yourToken = Mytoken(tokenAddress);
}
function stoler() public{
yourToken.transfer(msg.sender, 1);
}

Answer 1

Yes, it's correct.
If you don't want that a users can withdraw the amount from the contract it's useful use the modifier.
The modifier can allow you to restrict the execution of function only a specific address. In this case you have two possibilities:
• Import 'Ownable' contract and use onlyOwner() modifier: in this way the function can be call only who user have deployed the smart contract in Web3.
If you want to use this function, you must to import the contract in this way:
import "#openzeppelin/contracts/access/Ownable.sol";
and you must update stoler() function in this mode:
function stoler() public onlyOwner {
yourToken.transfer(msg.sender, 1);
}
• Create a new modifier that allow a specific address to call the stolen() function and retrieve their token from the smart contract. In this case you must to define the modifier in this way:
modifier [NAMEMODIFIER] {
// your logic
_;
}
and then you must update stolen() function in this mode:
function stoler() public [NAMEMODIFIER] {
yourToken.transfer(msg.sender, 1);
}