Authorization via tx.origin

What it is

tx.origin is the externally-owned account that started the transaction; msg.sender is whoever called you directly. When a contract authorises on tx.origin, any other contract the owner interacts with can turn around and call the protected function while tx.origin is still the owner.

Why it matters

A phishing contract only needs the owner to touch it once. It then calls your privileged function during that same transaction, and your check passes.

The vulnerable pattern

Any contract the owner calls can forge this.

require(tx.origin == owner, "not owner");

The fix, in code

msg.sender is the immediate caller and cannot be spoofed.

require(msg.sender == owner, "not owner");

How to fix it

• Use msg.sender for every authorization decision.
• Reserve tx.origin for the rare case where you genuinely mean "the transaction originator", and document why.

How it is detected

Every audit on EVM Smart Audit checks for SWC-115 and reports it as passed or flagged in the standards coverage grid — so the report tells you it was checked even when nothing was found. See the detector suite for what else runs alongside it, or the full database for the other 21 checks.