is it correct that i just need to input public address? if so, someone who know my public address can steal my coin
True. I wrote about this several times on Telegram group.
i asked to Blockpal support and here it their respond :
Dear Customer,
Thank you for your reply. This is a very good point you are making. I believe you are correct, and therefore I will infom the development team.
If there is anything else we can help you with just contact us here at support.
Best regards,
BlocPal Support