Operator Send does not use correct check

[fulldecent]

https://github.com/su-squares/ethereum-contract/blob/master/contracts/SuNFT.sol#L48

modifier canTransfer(uint256 _tokenId) {
    // assert(msg.sender != address(this))
    address owner = _tokenOwnerWithSubstitutions[_tokenId];
    require(msg.sender == owner ||
      msg.sender == tokenApprovals[_tokenId] ||
      operatorApprovals[msg.sender][msg.sender]);
    _;
}

should be

modifier canTransfer(uint256 _tokenId) {
    // assert(msg.sender != address(this))
    address owner = _tokenOwnerWithSubstitutions[_tokenId];
    require(msg.sender == owner ||
      msg.sender == tokenApprovals[_tokenId] ||
      operatorApprovals[owner][msg.sender]);
    _;
}

[fulldecent]

Credit goes to dfinzer at OpenSea! Thanks for your help.

[fulldecent]

Credit @dfinzer.