tx.origin

tx.origin is a global variable in Solidity that returns the address of the account that originally initiated the current transaction. Unlike msg.sender, which returns the immediate caller, tx.origin traces back through the entire call chain to the very first sender.

tx.origin vs msg.sender

1// Call chain: EOA -> ContractA -> ContractB
2
3// Inside ContractB:
4// tx.origin  == EOA (original transaction initiator)
5// msg.sender == ContractA (immediate caller)

Why tx.origin Is Dangerous for Authorization

Using tx.origin in require statements for access control creates a phishing vulnerability:

1// VULNERABLE — do not use for authorization
2function withdraw() external {
3    require(tx.origin == owner, "Not owner");
4    payable(msg.sender).transfer(address(this).balance);
5}

An attacker can deploy a malicious contract and trick the owner into calling it. Since tx.origin still points to the owner, the authorization check passes and funds are drained.

1// SECURE — use msg.sender instead
2function withdraw() external {
3    require(msg.sender == owner, "Not owner");
4    payable(msg.sender).transfer(address(this).balance);
5}

Valid Use Cases

tx.origin has limited legitimate uses:

1. Address blocking: Preventing a specific EOA from interacting with a contract, even through intermediary contracts
2. Ensuring human interaction: Verifying the caller is an EOA (not a contract), though msg.sender == tx.origin is a fragile check that breaks with account abstraction

Best Practice

Always use msg.sender for authorization. The Solidity documentation and security community strongly recommend against using tx.origin for access control.