fix: add missing GNFT transfer function access permission checks

[jinoosss]

The GNFT (Gnoswap NFT) contract was missing critical access control checks in its core transfer functions (SafeTransferFrom and TransferFrom). This security gap posed significant risks to the AMM (Automated Market Maker) system's stability and integrity.

The Security Issue

Before: Transfer functions lacked proper access control

func SafeTransferFrom(cur realm, from, to std.Address, tid grc721.TokenID) error {
    halt.AssertIsNotHaltedPosition()
    // Missing access control - any contract could call this
    
    assertFromIsValidAddress(from)
    assertToIsValidAddress(to)
    // ... transfer logic
}

After: Strict access control implemented

func SafeTransferFrom(cur realm, from, to std.Address, tid grc721.TokenID) error {
    halt.AssertIsNotHaltedPosition()
    
    caller := std.PreviousRealm().Address()
    access.AssertIsStaker(caller)  // Only staker contract can call
    
    assertFromIsValidAddress(from)
    assertToIsValidAddress(to)
    // ... transfer logic
}

Why Restrict to Staker Contract Only?

1. Controlled Liquidity Management

• The staker contract manages the complete lifecycle of staked positions
• NFT transfers must be synchronized with staking/unstaking operations
• Prevents positions from being transferred while earning rewards

Reward System Manipulation:

• Positions earning rewards could be transferred to avoid penalty periods
• Staking rewards are time-weighted and position-specific
• Unauthorized transfers could break reward calculation integrity

Liquidity Tracking Issues:

• The staker contract tracks which positions are earning rewards
• Random transfers would desynchronize staking state with NFT ownership
• Could lead to positions earning rewards without proper tracking

2. Proper Position Lifecycle

The intended flow ensures system consistency:

User Mints Position
        ↓
Receives GNFT (Ownership)
        ↓
Stakes Position → Transfer to Staker Contract
        ↓
Earns Rewards (Controlled State)
        ↓
Unstakes Position → Transfer back to User
        ↓
User Controls GNFT (Normal NFT Operations)

Security Benefits

1. Prevents Unauthorized Position Transfers

• Blocks malicious contracts from moving staked positions
• Ensures only the staker contract can manage position custody
• Protects users from unexpected position movements

2. Maintains AMM Stability

• Preserves reward calculation integrity
• Prevents staking state desynchronization
• Blocks potential economic exploits

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud