Ah, am I right that you are referring to something similar to what is discussed in this article? https://blocksecteam.medium.com/unlimited-approval-in-erc20-co

Ah, am I right that you are referring to something similar to what is discussed in this article? https://blocksecteam.medium.com/unlimited-approval-in-erc20-convenience-or-security-1c8dce421ed7 https://blocksecteam.medium.com/unlimited-approval-in-erc20-... But is it not the case that the approve() method must be invoked directly by the sender (i.e. by the account that holds the tokens that are the target of the theft)? Wouldn’t the invocation be rejected by the ERC20 token if it is made indirectly, i.e. if the invocation were made from within another method (provided that the target ERC20 token is coded properly)?