When a contract sends an inline action, it cannot send with the permission level passed by the caller, it sends with a special eosio.code permission name.

In your example, makepokemon can ony use [email protected] and not user@active, so user has to explictily give makepokemon permission to transfer tokens if they want to.

When a contract sends an inline action, it cannot send with the permission level passed by the caller; it sends with a special eosio.code permission name.

In your example, makepokemon can only use [email protected] and not user@active, so user has to explictily give makepokemon permission to transfer tokens if they want to.

When a contract sends an inline action, it cannot send with the permission level passed by the caller, it sends with a special eosio.code permission name.

In your example, makepokemon can ony use user@eosio.code and not user@active, so user has to explictily give makepokemon permission to transfer tokens if they want to.

When a contract sends an inline action, it cannot send with the permission level passed by the caller, it sends with a special eosio.code permission name.

In your example, makepokemon can ony use makepokemon@eosio.code and not user@active, so user has to explictily give makepokemon permission to transfer tokens if they want to.