Challenge 14

tx.origin Misuse

HighAccess control

Challenge

The withdrawal authorization uses tx.origin. Consider how an attacker could trick an owner into calling a malicious intermediary contract.

Starter code

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract VulnerableBank {
  mapping(address => uint256) public balances;

  function deposit() public payable {
    balances[msg.sender] += msg.value;
  }

  function withdraw(uint256 amount) public {
    require(tx.origin == msg.sender, "Not allowed");
    require(balances[msg.sender] >= amount, "Insufficient balance");
    balances[msg.sender] -= amount;
    payable(msg.sender).transfer(amount);
  }
}

Show hint

Use msg.sender for authorization; tx.origin can refer to an EOA several calls away.