Tx-Origin - Vulnerability exploit

     

---

---

🛡️ Smart Contract Security: msg.sender vs tx.origin

This project demonstrates a real-world smart contract vulnerability in Solidity caused by the misuse of tx.origin. It simulates a phishing attack exploiting the vulnerable withdrawAll() function, triggered through the attacker's maliciousFunction().

---

🧩 Project Structure

• BadVault.sol – Vulnerable contract with withdrawAll() relying on tx.origin.
• Attacker.sol – Malicious contract calling maliciousFunction() to exploit the vulnerability.
• GoodVault.sol – Safe contract version using msg.sender for authorization.

---

🧠 Core Concepts Covered

• ✅ msg.sender vs tx.origin
• ✅ Ether transfer using transfer()
• ✅ Cross-contract calls
• ✅ Solidity authorization patterns with require()

---

🚨 Simulated Vulnerability

The vulnerable withdrawAll() function uses tx.origin to check ownership. When maliciousFunction() is called in the attacker contract, it triggers a call to withdrawAll(), which sees the original transaction sender (tx.origin) as the wallet owner, passing the check and sending all funds to the attacker.

---

🛠️ How to Test in Remix

1. Open Remix.
2. Deploy BadVault.sol with some ETH.
3. Deploy Attacker.sol, passing BadVault’s address.
4. Switch to the owner account.
5. Call maliciousFunction() from the attacker contract.
6. Observe BadVault’s balance → it’s drained.

---

🔒 Key Lesson

• ❌ Never use tx.origin for critical access control.
• ✅ Always use msg.sender for reliable authorization.

---

📜 License

LGPL-3.0-only License