15.SWC-115_tx.origin

SWC-115_tx.origin

Authorization through tx.origin

• Description: tx.origin is a global variable in Solidity which returns the address of the account that sent the transaction. Using the variable for authorization could make a contract vulnerable if an authorized account calls into a malicious contract. A call could be made to the vulnerable contract that passes the authorization check since tx.origin returns the original sender of the transaction which in this case is the authorized account.

• Remediation: tx.origin should not be used for authorization. Use msg.sender instead.

vulnerability contract:

pragma solidity 0.4.24;

contract MyContract {

    address owner;

    function MyContract() public {
        owner = msg.sender;
    }

    function sendTo(address receiver, uint amount) public {
    	// Use tx.origin to authorize ETH withdrawls
    	// fixed: require(msg.sender == owner);
        require(tx.origin == owner); 
        receiver.transfer(amount);
    }

}