OpenZeppelin – Using OpenZeppelin Merkle Proof Library

You need to install the OpenZeppelin npm package into your project directory via yarn or npm like:

yarn add @openzeppelin/contracts

or

npm install --save @openzeppelin/contracts

Then import the SafeERC20.sol from those installed packages like:

import "@openzeppelin/contracts/<route to file>/SafeERC20.sol";

Then, you'll need to use it for IERC20 like:

using SafeERC20 for IERC20;

You don't need to import OpenZeppelin's Address.sol. If it's a dependency for IERC20, it will already be imported implicitly when you import SafeERC20.sol.

I would strongly advise against modifying the OpenZeppelin implementations.

You basically want to introduce a vulnerability where an account could spend funds belonging to another account without relying on explicit authorization.

Do not do that.

To make this work, you should rely on the allowance mechanism already included in OpenZeppelin ERC-20 implementation.

1. Account A approves account B to spend funds on its behalf.
2. Account B spends funds from account A to account C.

The spending in (2) is secured by the allowance mechanism present in the ERC-20 contract, and was explicitely allowed by the owner : Account A.

Alternatively, if you have control over the ERC-20 contract, you could simply inherit from it in your smart contract, no need for allowance then, as the user would be interacting directly with the contract holding the tokens, msg.sender would be the user's account address.

EDIT : Added code example to demonstrate the non preservation of msg.sender. Following the comments on the other answer.

pragma solidity ^0.8.0;

contract B {
    function testMsgSender(address supposedMsgSender) public view {
        require(supposedMsgSender == msg.sender, "msg.sender is not the right address");
    }
}

contract A {
    B contractInstance;
    
    constructor(address Baddress)
    {
        contractInstance = B(Baddress);
    }
    
    function test() public view {
        contractInstance.testMsgSender(msg.sender);
    }
}

You can deploy this code on Remix.

1. Deploy B
2. Deploy A by giving B's address to the contructor

Call A.test and you will see the following error message :

"msg.sender is not the right address"