TX.origin authentication vulnerabilities occur when contracts use tx.origin instead of msg.sender for authorization. Learn why this is dangerous and how to implement proper access controls.
Understanding the difference between tx.origin and msg.sender is crucial for smart contract security. TX.origin returns the original external account that started the transaction, while msg.sender returns the immediate caller of the current function.
Attacker tricks user into calling malicious contract that drains their wallet through tx.origin authorization.
Fake DApps or games that appear legitimate but exploit tx.origin vulnerabilities in user's contracts.
Using legitimate contracts as proxies to bypass tx.origin-based access controls.
tx.origin always refers to the original EOA (externally owned account) that initiated a transaction chain — not the immediate caller. Using it for authentication means a malicious contract in the call chain can trick the check: if a user calls AttackerContract, which calls VictimContract, tx.origin is still the user's address and the check passes even though the victim is being called by the attacker.
An attacker deploys a malicious contract and tricks a victim (e.g., a wallet owner) into calling it — perhaps via a fake NFT claim or airdrop. The malicious contract then calls the victim's smart contract (e.g., a wallet contract with tx.origin authorization). Since tx.origin is the victim's EOA, the authorization check passes and the attacker can drain the wallet.
Always use msg.sender for authorization. msg.sender is the immediate caller of a function — it correctly identifies whether a contract or EOA is calling you. The only safe use case for tx.origin is blocking contract calls entirely: `require(tx.origin == msg.sender)` ensures only EOAs can call a function, which is sometimes intentional but usually not what developers mean.
Yes. The most well-known example is the CoinDash ICO redirect (2017), and several wallet contracts with tx.origin authorization have been drained. Solidity's own documentation warns against tx.origin authentication, and it's flagged in every major security audit checklist.
Replace every `require(tx.origin == owner)` or `tx.origin` authorization check with `require(msg.sender == owner)`. If you intentionally want to restrict to EOAs only, use `require(tx.origin == msg.sender)` — but document why. SmartContractAuditor.ai automatically flags all tx.origin usage and distinguishes between intentional EOA-only gates and accidental authentication errors.