Description
send() does not check the owner of the to be sent nfts, which allows anyone to send nfts to itself on behalf of someone else. See the POC here.
Recommendation
Add _isApprovedOrOwner() on the nfts to be sent in send().
Status
Addressed in f34458d.
