Properly (safely) verify that transaction contains an Cardano Native Token or NFT

Question

All the available on-chain validator programs that limit certain redeemer actions to transactions containing an NFT use

hasToken :: TxOut -> Bool
hasToken txOut = assetClassValueOf (txOutValue txOut) (AssetClass{unAssetClass = ("something", TokenName "somename")}) == 1

Including Plutus Pioneer week 6

Is there anything preventing a malicious user from minting a token with a currency symbol "something" and TokenName "somename" and then just performing the transaction? (edited)

How can on-chain validators make sure that the redeemer action can only be completed by a transaction containing a Cardano Native Token or NFT with the given CurrencySymbol, TokenName AND PolicyId so that we can make sure that the asset was not minted by a malicious party.

Answer 1

The currency symbol is the hash of a minting policy script. This includes data like the paymentpubkey hash that can burn and mint. If someone wanted to use the same currency symbol as you, they would need the keys to the address that can mint or burn. Without those keys, they wouldn't be able to sign minting or burning transactions. Keep those keys safe.

I believe in the previous week (week 5), there was a lecture on a more realistic minting policy that specifies a paymentpubkey hash to allow minting.