VerifyTransfer in fabtoken is a local debug verification function, not the on-chain validator

[NETIZEN-11]

The VerifyTransfer function located at token/core/fabtoken/v1/transfer.go:184-188 was initially flagged as a critical
security issue because it returned nil without performing any verification. However, upon clarification from the
maintainer, this understanding was incorrect.

Key Points:

1. VerifyTransfer is NOT the validator: This function is NOT executed by the token validator during transaction
   processing. It is a local verification function that parties can optionally use to verify if a transfer action is
   valid locally - primarily for debugging purposes.
2. Actual validation happens elsewhere: The real on-chain validation is performed by these properly implemented
   validator functions in token/core/fabtoken/v1/validator/:
   - TransferActionValidate - Validates the transfer action structure
   - TransferSignatureValidate - Validates signatures for inputs spent by an action
   - TransferBalanceValidate - Checks that sum of inputs equals sum of outputs
   - TransferHTLCValidate - Validates HTLC scripts if present
3. Implementation status: The VerifyTransfer function has now been implemented , but this is a
   "nice to have" feature for local verification - not a security-critical gap since the actual validation is handled by
   the separate validator functions.

[NETIZEN-11]

@adecaro Hi, instead of updating the original issue, I closed it and created a new clarification issue with a more accurate title and scope based on your explanation.
The new issue now reflects that VerifyTransfer is mainly a local verification/debugging function and not the on-chain validator.
Could you please review the PR when you get a chance? Thanks again for the clarification and guidance 🙏

[AkramBitar]

@adecaro Hi, instead of updating the original issue, I closed it and created a new clarification issue with a more accurate title and scope based on your explanation. The new issue now reflects that VerifyTransfer is mainly a local verification/debugging function and not the on-chain validator. Could you please review the PR when you get a chance? Thanks again for the clarification and guidance 🙏

Hello @NETIZEN-11 thanks a lot for working on that issue.

Based on your explanation, should this issue remain open, or would you prefer that I close it?
if we need to keep it open, could you please explain what it should fix.

Thanks a lot,
Akram

[AkramBitar]

Hello @NETIZEN-11 did you have the chance to look at my above comment?