Challenge 5

tx.origin Misuse

InfoAccess control

Challenge

The source labels this as a tx.origin access-control issue. Review the wallet's deposit and withdrawal paths.

Starter code

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Wallet {
  mapping(address => uint256) public balances;

  function deposit() public payable {
    balances[msg.sender] += msg.value;
  }

  function withdraw(uint256 amount) public {
    require(balances[msg.sender] >= amount, "Insufficient balance");
    balances[msg.sender] -= amount;
    payable(msg.sender).transfer(amount);
  }
}

Show hint

Never use tx.origin for authorization. Prefer msg.sender, and verify that the sample actually contains the reported pattern.