1import{bj as v,j as e,aM as A,aQ as k,L as n,m as h,l as o,az as l,aA as c,aD as O,aE as C,aF as x,aG as m,h as s,an as t,ao as a,i as r,x as u,as as i,P as z,aY as S,S as R,O as E,Z as I,B as p,ag as T}from"./index-DJZuVyTC.js";import{H as U}from"./HubLinksStrip-CYWUGvHy.js";import{R as D}from"./refresh-cw-UcLF5XYY.js";import{T as d}from"./triangle-alert-CEWMGGTe.js";import{B as V}from"./book-open-Cr-t0wwZ.js";import{U as j}from"./users-CFNFzAWS.js";import{K as q}from"./key-Co_qV10H.js";import{B as L}from"./bug-DA0Y84ob.js";function X(){const b={initial:{opacity:0,y:60},animate:{opacity:1,y:0},transition:{duration:.6}},g=[{question:"What is tx.origin authentication in Solidity and why is it dangerous?",answer:"tx.origin always refers to the original EOA (externally owned account) that initiated a transaction chain â not the immediate caller. Using it for authentication means a malicious contract in the call chain can trick the check: if a user calls AttackerContract, which calls VictimContract, tx.origin is still the user's address and the check passes even though the victim is being called by the attacker."},{question:"How does a tx.origin phishing attack work?",answer:"An attacker deploys a malicious contract and tricks a victim (e.g., a wallet owner) into calling it â perhaps via a fake NFT claim or airdrop. The malicious contract then calls the victim's smart contract (e.g., a wallet contract with tx.origin authorization). Since tx.origin is the victim's EOA, the authorization check passes and the attacker can drain the wallet."},{question:"What should I use instead of tx.origin for authentication?",answer:"Always use msg.sender for authorization. msg.sender is the immediate caller of a function â it correctly identifies whether a contract or EOA is calling you. The only safe use case for tx.origin is blocking contract calls entirely: `require(tx.origin == msg.sender)` ensures only EOAs can call a function, which is sometimes intentional but usually not what developers mean."},{question:"Has tx.origin misuse caused real smart contract exploits?",answer:"Yes. The most well-known example is the CoinDash ICO redirect (2017), and several wallet contracts with tx.origin authorization have been drained. Solidity's own documentation warns against tx.origin authentication, and it's flagged in every major security audit checklist."},{question:"How do I fix a tx.origin vulnerability in my Solidity contract?",answer:"Replace every `require(tx.origin == owner)` or `tx.origin` authorization check with `require(msg.sender == owner)`. If you intentionally want to restrict to EOAs only, use `require(tx.origin == msg.sender)` â but document why. SmartContractAuditor.ai automatically flags all tx.origin usage and distinguishes between intentional EOA-only gates and accidental authentication errors."}],w={"@context":"https://schema.org","@graph":[{"@type":"Article","@id":"https://smartcontractauditor.ai/vulnerabilities/tx-origin-authentication#article",headline:"TX.Origin Authentication Vulnerability: Complete Security Guide",description:"Learn about tx.origin authentication vulnerabilities in smart contracts, how they differ from msg.sender, and why tx.origin should never be used for authorization.",author:{"@type":"Organization",name:"SmartContractAuditor.ai"},publisher:{"@type":"Organization",name:"SmartContractAuditor.ai"},datePublished:"2024-01-15",dateModified:"2024-01-15",mainEntityOfPage:{"@type":"WebPage","@id":"https://smartcontractauditor.ai/vulnerabilities/tx-origin-authentication"}},v(g)]};return e.jsxs("div",{className:"min-h-screen bg-gradient-to-br from-slate-50 via-white to-blue-50",children:[e.jsx(A,{title:"TX.Origin Authentication Vulnerability: Complete Security Guide",description:"Learn about tx.origin authentication vulnerabilities in smart contracts, how they differ from msg.sender, and why tx.origin should never be used for authorization.",keywords:"tx.origin vulnerability, tx origin authentication, msg.sender vs tx.origin, smart contract authorization, tx.origin attack, ethereum tx.origin, solidity tx.origin",canonicalUrl:"https://smartcontractauditor.ai/vulnerabilities/tx-origin-authentication",structuredData:w}),e.jsx(k,{}),e.jsx("div",{className:"bg-slate-50 py-4",children:e.jsx("div",{className:"container mx-auto px-4",children:e.jsxs("nav",{className:"text-sm",children:[e.jsx(n,{href:"/",className:"text-slate-600 hover:text-slate-900",children:"Home"}),e.jsx("span",{className:"mx-2 text-slate-400",children:"/"}),e.jsx("span",{className:"text-slate-600",children:"Vulnerabilities"}),e.jsx("span",{className:"mx-2 text-slate-400",children:"/"}),e.jsx("span",{className:"text-slate-900 font-medium",children:"TX.Origin Authentication"})]})})}),e.jsx("section",{className:"py-16 lg:py-24",children:e.jsx("div",{className:"container mx-auto px-4 max-w-4xl",children:e.jsxs(h.div,{className:"text-center mb-12",...b,children:[e.jsxs(o,{className:"mb-6 bg-yellow-100 text-yellow-700 hover:bg-yellow-200 border-yellow-200",children:[e.jsx(D,{className:"w-4 h-4 mr-1"}),"Authorization Vulnerability"]}),e.jsxs("h1",{className:"text-4xl md:text-6xl font-bold text-slate-900 mb-6 leading-tight",children:["TX.Origin Authentication",e.jsx("br",{}),e.jsx("span",{className:"text-yellow-600",children:"Security Vulnerability"})]}),e.jsx("p",{className:"text-xl text-slate-600 mb-8 leading-relaxed",children:"TX.origin authentication vulnerabilities occur when contracts use tx.origin
1instead of msg.sender for authorization. Learn why this is dangerous and how to implement proper access controls."}),e.jsxs(l,{className:"mb-8 border-yellow-200 bg-yellow-50",children:[e.jsx(d,{className:"h-4 w-4 text-yellow-600"}),e.jsxs(c,{className:"text-yellow-800",children:[e.jsx("strong",{children:"Critical Rule:"})," Never use tx.origin for authorization in smart contracts. It can be easily bypassed through proxy contracts and social engineering attacks."]})]})]})})}),e.jsx("section",{className:"py-16",children:e.jsx("div",{className:"container mx-auto px-4 max-w-4xl",children:e.jsxs(O,{defaultValue:"overview",className:"w-full",children:[e.jsxs(C,{className:"grid w-full grid-cols-4 mb-8",children:[e.jsx(x,{value:"overview","data-testid":"tab-overview",children:"Overview"}),e.jsx(x,{value:"examples","data-testid":"tab-examples",children:"Code Examples"}),e.jsx(x,{value:"prevention","data-testid":"tab-prevention",children:"Prevention"}),e.jsx(x,{value:"detection","data-testid":"tab-detection",children:"Detection"})]}),e.jsx(m,{value:"overview",children:e.jsxs("div",{className:"space-y-8",children:[e.jsxs(s,{children:[e.jsx(t,{children:e.jsxs(a,{className:"flex items-center",children:[e.jsx(V,{className:"w-6 h-6 text-blue-600 mr-3"}),"TX.Origin vs MSG.Sender"]})}),e.jsxs(r,{className:"prose prose-slate max-w-none",children:[e.jsx("p",{className:"text-lg text-slate-700 leading-relaxed",children:"Understanding the difference between tx.origin and msg.sender is crucial for smart contract security. TX.origin returns the original external account that started the transaction, while msg.sender returns the immediate caller of the current function."}),e.jsxs("div",{className:"grid md:grid-cols-2 gap-6 mt-6",children:[e.jsxs("div",{className:"bg-green-50 p-6 rounded-lg",children:[e.jsxs("h4",{className:"font-semibold text-green-800 mb-3 flex items-center",children:[e.jsx(u,{className:"w-5 h-5 mr-2"}),"MSG.Sender (Secure)"]}),e.jsxs("ul",{className:"space-y-2 text-green-700 text-sm",children:[e.jsx("li",{children:"⢠Returns immediate caller"}),e.jsx("li",{children:"⢠Changes with each call"}),e.jsx("li",{children:"⢠Can be contracts or EOAs"}),e.jsx("li",{children:"⢠Proper for authorization"}),e.jsx("li",{children:"⢠Cannot be manipulated"})]})]}),e.jsxs("div",{className:"bg-red-50 p-6 rounded-lg",children:[e.jsxs("h4",{className:"font-semibold text-red-800 mb-3 flex items-center",children:[e.jsx(d,{className:"w-5 h-5 mr-2"}),"TX.Origin (Vulnerable)"]}),e.jsxs("ul",{className:"space-y-2 text-red-700 text-sm",children:[e.jsx("li",{children:"⢠Returns original transaction signer"}),e.jsx("li",{children:"⢠Stays same throughout call chain"}),e.jsx("li",{children:"⢠Always an externally owned account"}),e.jsx("li",{children:"⢠Dangerous for authorization"}),e.jsx("li",{children:"⢠Can be exploited via proxy"})]})]})]})]})]}),e.jsxs(s,{children:[e.jsx(t,{children:e.jsxs(a,{className:"flex items-center",children:[e.jsx(j,{className:"w-6 h-6 text-purple-600 mr-3"}),"How TX.Origin Attacks Work"]})}),e.jsxs(r,{children:[e.jsx("div",{className:"bg-slate-50 p-6 rounded-lg",children:e.jsxs("ol",{className:"space-y-3",children:[e.jsxs("li",{className:"flex items-start gap-3",children:[e.jsx(o,{className:"bg-blue-100 text-blue-800 mt-1",children:"1"}),e.jsx("span",{children:"Attacker creates a malicious contract"})]}),e.jsxs("li",{className:"flex items-start gap-3",children:[e.jsx(o,{className:"bg-blue-100 text-blue-800 mt-1",children:"2"}),e.jsx("span",{children:"Tricks victim into calling the malicious contract"})]}),e.jsxs("li",{className:"flex items-start gap-3",children:[e.jsx(o,{className:"bg-blue-100 text-blue-800 mt-1",children:"3"}),e.jsx("span",{children:"Malicious contract calls victim's vulnerable contract"})]}),e.jsxs("li",{className:"flex items-start gap-3",children:[e.jsx(o,{className:"bg-red-100 text-red-800 mt-1",children:"4"}),e.jsx("span",{children:"tx.origin still points to victim, bypassing access control"})]})]})}),e.jsxs(l,{className:"mt-6 border-emerald-200 bg-purple-50",children:[e.jsx(j,{className:"h-4 w-4 text-purple-600"}),e.jsxs(c,{className:"text-purple-800",children:[e.jsx("strong",{children:"Social Engineering Component:"})," TX.origin attacks often rely on tricking users into interacting with malicious contracts, making them particularly dangerous."]})]})]})]}),e.jsxs(s,{children:[e.jsx(t,{children:e.jsxs(a,{className:"flex items-center",children:[e.jsx(q,{className:"w-6 h-6 text-orange-600 mr-3"}),"Common Attack Scenarios"]})}),e.jsx(r,{children:e.jsxs("div",{className:"space-y-6",children:[e.jsxs("div",{className:"border-l-4 border-red-500 pl-4",children:[e.jsx("h4",{className:"font-semibold text-red-800",children:"Wallet Drain Attack"}),e.jsx("p",{className:"text-slate-600 text-sm mt-1",children:"Attacker tricks user into calling malicious contract that drains their wallet through tx.origin authorization."})]}),e.jsxs("div",{className:"border-l-4 border-orange-500 pl-4",children:[e.jsx("h4",{className:"font-semibold text-orange-800",children:"Phishing Contracts"}),e.jsx("p",{className:"text-slate-600 text-sm mt-1",children:"Fake DApps or games that appear legitimate but exploit tx.origin vulnerabilities in user's contracts."})]}),e.jsxs("div",{className:"border-l-4 border-yellow-500 pl-4",children:[e.jsx("h4",{className:"font-semibold text-yellow-800",children:"Cross-Contract Exploitation"}),e.jsx("p",{className:"text-slate-600 text-sm mt-1",children:"Using legitimate contracts as proxies to bypass tx.origin-based access controls."})]})]})})]})]})}),e.jsx(m,{value:"examples",children:e.jsxs("div",{className:"space-y-8",children:[e.jsxs(s,{children:[e.jsxs(t,{children:[e.jsxs(a,{className:"flex items-center",children:[e.jsx(L,{className:"w-6 h-6 text-red-600 mr-3"}),"Vulnerable TX.Origin Implementation"]}),e.jsx(i,{children:"Dangerous use of tx.origin for authorization"})]}),e.jsxs(r,{children:[e.jsx("div",{className:"bg-slate-900 p-6 rounded-lg",children:e.jsx("pre",{className:"text-slate-300 overflow-x-auto",children:e.jsx("code",{children:`// â VULNERABLE - Using tx.origin for authorization 2contract VulnerableWallet { 3 address public owner; 4 5 constructor() { 6 owner = msg.sender; 7 } 8
9 // ð¨ DANGEROUS - Uses tx.origin instead of msg.sender 10 modifier onlyOwner() { 11 require(tx.origin == owner, "Not owner"); 12 _; 13 } 14 15 function withdraw(uint256 amount) public onlyOwner { 16 payable(owner).transfer(amount); 17 } 18 19 function transferOwnership(address newOwner) public onlyOwner { 20 owner = newOwner; 21 } 22 23 // ð¨ All functions using onlyOwner are vulnerable! 24 function emergencyWithdraw() public onlyOwner { 25 payable(owner).transfer(address(this).balance); 26 } 27 28 receive() external payable {} 29}`})})}),e.jsxs(l,{className:"mt-4 border-red-200 bg-red-50",children:[e.jsx(d,{className:"h-4 w-4 text-red-600"}),e.jsxs(c,{className:"text-red-800",children:[e.jsx("strong",{children:"Critical flaw:"})," Any contract that the owner interacts with can call these functions because tx.origin will still point to the owner."]})]})]})]}),e.jsxs(s,{children:[e.jsxs(t,{children:[e.jsxs(a,{className:"flex items-center",children:[e.jsx(z,{className:"w-6 h-6 text-orange-600 mr-3"}),"Attack Contract Example"]}),e.jsx(i,{children:"How attackers exploit tx.origin vulnerabilities"})]}),e.jsxs(r,{children:[e.jsx("div",{className:"bg-slate-900 p-6 rounded-lg",children:e.jsx("pre",{className:"text-slate-300 overflow-x-auto",children:e.jsx("code",{children:`contract TxOriginAttacker { 30 VulnerableWallet public target; 31 address public attacker; 32 33 constructor(address _target) { 34 target = VulnerableWallet(_target); 35 attacker = msg.sender; 36 } 37 38 // Innocent-looking function that tricks users 39 function claimReward() public { 40 // User thinks they're claiming a reward 41 // But this function exploits their wallet! 42 43 // When user calls this, tx.origin = user's address 44 // So the vulnerable wallet thinks the user is calling directly 45 target.emergencyWithdraw(); 46 47 // Funds get sent to the wallet owner (the user) 48 // But attacker can front-run or use other techniques 49 } 50 51 // Alternative attack: Change ownership 52 function stealOwnership() public { 53 // If user calls this, tx.origin = user's address 54 // Vulnerable contract allows ownership transfer 55 target.transferOwnership(attacker); 56 57 // Now attacker owns the wallet! 58 } 59 60 // Social engineering function 61 function "playGame"() public { 62 // Appears to be a harmless game function 63 // Actually drains user's wallet 64 target.withdraw(target.balance); 65 } 66}`})})}),e.jsxs(l,{className:"mt-4 border-orange-200 bg-orange-50",children:[e.jsx(d,{className:"h-4 w-4 text-orange-600"}),e.jsxs(c,{className:"text-orange-800",children:[e.jsx("strong",{children:"Attack vector:"})," The attacker creates innocent-looking functions that trick users into calling them, then exploit tx.origin-based authorization."]})]})]})]}),e.jsxs(s,{children:[e.jsxs(t,{children:[e.jsxs(a,{className:"flex items-center",children:[e.jsx(S,{className:"w-6 h-6 text-blue-600 mr-3"}),"Call Chain Demonstration"]}),e.jsx(i,{children:"Understanding how tx.origin vs msg.sender behave in call chains"})]}),e.jsx(r,{children:e.jsxs("div",{className:"bg-slate-50 p-6 rounded-lg",children:[e.jsx("h4",{className:"font-semibold mb-4",children:"Attack Scenario Call Chain:"}),e.jsxs("div",{className:"space-y-3 text-sm",children:[e.jsxs("div",{className:"bg-white p-3 rounded border-l-4 border-blue-500",children:[e.jsx("strong",{children:"1. User â AttackerContract.claimReward()"}),e.jsx("br",{}),e.jsx("span",{className:"text-slate-600",children:"tx.origin: User, msg.sender: User"})]}),e.jsxs("div",{className:"bg-white p-3 rounded border-l-4 border-orange-500",children:[e.jsx("strong",{children:"2. AttackerContract â VulnerableWallet.withdraw()"}),e.jsx("br",{}),e.jsx("span",{className:"text-slate-600",children:"tx.origin: User, msg.sender: AttackerContract"})]}),e.jsxs("div",{className:"bg-red-50 p-3 rounded border-l-4 border-red-500",children:[e.jsx("strong",{children:"3. VulnerableWallet checks tx.origin == owner"}),e.jsx("br",{}),e.jsx("span",{className:"text-red-600",children:"â Passes! (User is the owner)"}),e.jsx("br",{}),e.jsx("span",{className:"text-red-600",children:"ð¨ Attack succeeds despite being called by AttackerContract"})]})]}),e.jsx("h4",{className:"font-semibold mt-6 mb-4",children:"Secure Implementation Would Check:"}),e.jsxs("div",{className:"bg-green-50 p-3 rounded border-l-4 border-green-500",children:[e.jsx("strong",{children:"msg.sender == owner"}),e.jsx("br",{}),e.jsx("span",{className:"text-green-600",children:"â Fails! (AttackerContract â User)"}),e.jsx("br",{}),e.jsx("span",{className:"text-green-600",children:"ð¡ï¸ Attack prevented"})]})]})})]})]})}),e.jsx(m,{value:"prevention",children:e.jsxs("div",{className:"space-y-8",children:[e.jsxs(s,{children:[e.jsxs(t,{children:[e.jsxs(a,{className:"flex items-center",children:[e.jsx(u,{className:"w-6 h-6 text-green-600 mr-3"}),"Secure Authorization Implementation"]}),e.jsx(i,{children:"Always use msg.sender for proper access control"})]}),e.jsxs(r,{children:[e.jsx("div",{className:"bg-slate-900 p-6 rounded-lg",children:e.jsx("pre",{className:"text-slate-300 overflow-x-auto",children:e.jsx("code",{children:`// â SECURE - Using msg.sender for authorization 67contract SecureWallet { 68 address public owner; 69 70 constructor() { 71 owner = msg.sender; 72 } 73 74 // â SECURE - Uses msg.sender instead of tx.origin 75 modifier onlyOwner() { 76 require(msg.sender == owner, "Caller is not the owner"); 77 _; 78 } 79 80 function withdraw(uint256 amount) public onlyOwner { 81 require(amount <= address(this).balance, "Insufficient balance"); 82 payable(owner).transfer(amount); 83 } 84 85 function transferOwnership(address newOwner) public onlyOwner { 86 require(newOwner != address(0), "New owner cannot be zero address"); 87 require(newOwner != owner, "New owner must be different"); 88 89 address previousOwner = owner; 90 owner = newOwner; 91 emit OwnershipTransferred(previousOwner, newOwner); 92 } 93 94 // â Additional security with event logging 95 event OwnershipTransferred(address indexed previousOwner, address indexed newOwner); 96 97 // â Secure emergency function 98 function emergencyWithdraw() public onlyOwner { 99 uint256 balance = address(this).balance; 100 require(balance > 0, "No funds to withdraw"); 101 102 payable(owner).transfer(balance); 103 emit EmergencyWithdrawal(owner, balance); 104 } 105 106 event EmergencyWithdrawal(address indexed owner, uint256 amount); 107 108 receive() external payable {} 109}`})})}),e.jsxs(l,{className:"mt-4 border-green-200 bg-green-50",children:[e.jsx(u,{className:"h-4 w-4 text-green-600"}),e.jsxs(c,{className:"text-green-800",children:[e.jsx("strong",{children:"Security improvement:"})," Using msg.sender ensures only the direct caller can execute privileged functions, preventing proxy contract attacks."]})]})]})]}),e.jsxs(s,{children:[e.jsxs(t,{children:[e.jsxs(a,{className:"flex items-center",children:[e.jsx(R,{className:"w-6 h-6 text-blue-600 mr-3"}),"Advanced Access Control Patterns"]}),e.jsx(i,{children:"Using OpenZeppelin's AccessControl for robust authorization"})]}),e.jsx(r,{children:e.jsx("div",{className:"bg-slate-900 p-6 rounded-lg",children:e.jsx("pre",{className:"text-slate-300 overflow-x-auto",children:e.jsx("code",{children:`import "@openzeppelin/contracts/access/AccessControl.s
109ol"; 110import "@openzeppelin/contracts/security/ReentrancyGuard.sol"; 111 112contract AdvancedSecureContract is AccessControl, ReentrancyGuard { 113 bytes32 public constant ADMIN_ROLE = keccak256("ADMIN_ROLE"); 114 bytes32 public constant OPERATOR_ROLE = keccak256("OPERATOR_ROLE"); 115 116 constructor() { 117 // Grant admin role to deployer 118 _grantRole(DEFAULT_ADMIN_ROLE, msg.sender); 119 _grantRole(ADMIN_ROLE, msg.sender); 120 } 121 122 // â Role-based access control (never uses tx.origin) 123 function withdraw(uint256 amount) 124 external 125 onlyRole(ADMIN_ROLE) 126 nonReentrant 127 { 128 require(amount <= address(this).balance, "Insufficient balance"); 129 payable(msg.sender).transfer(amount); 130 } 131 132 // â Granular permissions 133 function operatorFunction() external onlyRole(OPERATOR_ROLE) { 134 // Operator-specific functionality 135 } 136 137 // â Multi-signature like functionality 138 mapping(bytes32 => uint256) public proposalVotes; 139 mapping(bytes32 => mapping(address => bool)) public hasVoted; 140 141 function proposeWithdrawal(uint256 amount) external onlyRole(ADMIN_ROLE) returns (bytes32) { 142 bytes32 proposalId = keccak256(abi.encode(amount, block.timestamp)); 143 proposalVotes[proposalId] = 1; 144 hasVoted[proposalId][msg.sender] = true; 145 return proposalId; 146 } 147 148 function voteOnProposal(bytes32 proposalId) external onlyRole(ADMIN_ROLE) { 149 require(!hasVoted[proposalId][msg.sender], "Already voted"); 150 hasVoted[proposalId][msg.sender] = true; 151 proposalVotes[proposalId]++; 152 } 153}`})})})})]}),e.jsxs(s,{children:[e.jsx(t,{children:e.jsx(a,{children:"Authorization Security Best Practices"})}),e.jsx(r,{children:e.jsxs("div",{className:"grid md:grid-cols-2 gap-6",children:[e.jsxs("div",{children:[e.jsxs("h4",{className:"font-semibold text-green-700 mb-3 flex items-center",children:[e.jsx(u,{className:"w-5 h-5 mr-2"}),"Secure Practices"]}),e.jsxs("ul",{className:"space-y-2 text-slate-700",children:[e.jsx("li",{children:"⢠Always use msg.sender for authorization"}),e.jsx("li",{children:"⢠Implement role-based access control"}),e.jsx("li",{children:"⢠Use established libraries like OpenZeppelin"}),e.jsx("li",{children:"⢠Add event logging for transparency"}),e.jsx("li",{children:"⢠Implement multi-signature for critical functions"}),e.jsx("li",{children:"⢠Validate all inputs and state changes"})]})]}),e.jsxs("div",{children:[e.jsxs("h4",{className:"font-semibold text-red-700 mb-3 flex items-center",children:[e.jsx(d,{className:"w-5 h-5 mr-2"}),"Dangerous Patterns"]}),e.jsxs("ul",{className:"space-y-2 text-slate-700",children:[e.jsx("li",{children:"⢠Never use tx.origin for authorization"}),e.jsx("li",{children:"⢠Avoid single points of failure"}),e.jsx("li",{children:"⢠Don't trust external contracts blindly"}),e.jsx("li",{children:"⢠Avoid complex authorization logic"}),e.jsx("li",{children:"⢠Don't ignore social engineering risks"}),e.jsx("li",{children:"⢠Avoid hardcoded addresses when possible"})]})]})]})})]})]})}),e.jsx(m,{value:"detection",children:e.jsxs("div",{className:"space-y-8",children:[e.jsxs(s,{children:[e.jsxs(t,{children:[e.jsxs(a,{className:"flex items-center",children:[e.jsx(E,{className:"w-6 h-6 text-purple-600 mr-3"}),"Automated Detection Methods"]}),e.jsx(i,{children:"How our AI identifies tx.origin vulnerabilities"})]}),e.jsxs(r,{children:[e.jsxs("div",{className:"grid md:grid-cols-2 gap-6",children:[e.jsxs("div",{children:[e.jsx("h4",{className:"font-semibold mb-3",children:"Detection Techniques"}),e.jsxs("ul",{className:"space-y-2 text-slate-700",children:[e.jsx("li",{children:"⢠tx.origin usage scanning"}),e.jsx("li",{children:"⢠Authorization pattern analysis"}),e.jsx("li",{children:"⢠Modifier implementation review"}),e.jsx("li",{children:"⢠Access control flow tracing"}),e.jsx("li",{children:"⢠Function visibility assessment"})]})]}),e.jsxs("div",{children:[e.jsx("h4",{className:"font-semibold mb-3",children:"Warning Signs"}),e.jsxs("ul",{className:"space-y-2 text-slate-700",children:[e.jsx("li",{children:"⢠tx.origin
153in require statements"}),e.jsx("li",{children:"⢠tx.origin in modifier conditions"}),e.jsx("li",{children:"⢠tx.origin comparisons for auth"}),e.jsx("li",{children:"⢠Missing msg.sender usage"}),e.jsx("li",{children:"⢠Inadequate access controls"})]})]})]}),e.jsxs(l,{className:"mt-6 border-emerald-200 bg-purple-50",children:[e.jsx(I,{className:"h-4 w-4 text-purple-600"}),e.jsxs(c,{className:"text-purple-800",children:[e.jsx("strong",{children:"Instant Detection:"})," Our scanner immediately flags any usage of tx.origin for authorization and provides secure alternatives using msg.sender."]})]})]})]}),e.jsxs(s,{children:[e.jsx(t,{children:e.jsx(a,{children:"Manual Code Review Checklist"})}),e.jsx(r,{children:e.jsxs("div",{className:"space-y-4",children:[e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx("input",{type:"checkbox",className:"mt-1"}),e.jsx("span",{children:"No usage of tx.origin for authorization anywhere in the contract"})]}),e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx("input",{type:"checkbox",className:"mt-1"}),e.jsx("span",{children:"All access control uses msg.sender instead of tx.origin"})]}),e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx("input",{type:"checkbox",className:"mt-1"}),e.jsx("span",{children:"Modifiers properly implement authorization checks"})]}),e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx("input",{type:"checkbox",className:"mt-1"}),e.jsx("span",{children:"Critical functions have proper access restrictions"})]}),e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx("input",{type:"checkbox",className:"mt-1"}),e.jsx("span",{children:"Role-based access control is implemented where appropriate"})]}),e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx("input",{type:"checkbox",className:"mt-1"}),e.jsx("span",{children:"Authorization changes emit appropriate events"})]})]})})]})]})})]})})}),e.jsx("section",{className:"relative z-10 py-16",children:e.jsxs("div",{className:"container mx-auto px-4 max-w-3xl",children:[e.jsx("h2",{className:"text-2xl font-bold text-white mb-8",children:"Frequently Asked Questions"}),e.jsx("div",{className:"space-y-3",children:g.map(({question:f,answer:y},N)=>e.jsxs("details",{className:"border border-white/10 rounded-lg p-4 bg-white/5",children:[e.jsxs("summary",{className:"font-semibold text-white cursor-pointer list-none flex items-center justify-between",children:[f,e.jsx("span",{className:"text-slate-400 ml-4 flex-shrink-0",children:"+"})]}),e.jsx("p",{className:"text-slate-300 mt-3 leading-relaxed text-sm",children:y})]},N))})]})}),e.jsx("section",{className:"py-16 bg-slate-50",children:e.jsxs("div",{className:"container mx-auto px-4 max-w-6xl",children:[e.jsx("h2",{className:"text-3xl font-bold text-center mb-12",children:"Related Authorization Vulnerabilities"}),e.jsxs("div",{className:"grid md:grid-cols-3 gap-6",children:[e.jsx(n,{href:"/vulnerabilities/access-control-flaws",children:e.jsx(s,{className:"cursor-pointer hover:shadow-lg transition-all duration-300 border-2 border-transparent hover:border-blue-200",children:e.jsxs(t,{children:[e.jsx(a,{className:"text-lg",children:"Access Control Flaws"}),e.jsx(i,{children:"Missing authorization checks and improper permission systems"})]})})}),e.jsx(n,{href:"/vulnerabilities/reentrancy-attacks",children:e.jsx(s,{className:"cursor-pointer hover:shadow-lg transition-all duration-300 border-2 border-transparent hover:border-blue-200",children:e.jsxs(t,{children:[e.jsx(a,{className:"text-lg",children:"Reentrancy Attacks"}),e.jsx(i,{children:"External calls before state updates allowing recursive exploitation"})]})})}),e.jsx(n,{href:"/vulnerabilities/upgradeable-contract-bugs",children:e.jsx(s,{className:"cursor-pointer hover:shadow-lg transition-all duration-300 border-2 border-transparent hover:border-blue-200",children:e.jsxs(t,{children:[e.jsx(a,{className:"text-lg",children:"Upgradeable Contract Bugs"}),e.jsx(i,{children:"Vulnerabilities in proxy patterns and upgrade mechanisms"})]})})})]})]})}),e.jsx(U,{}),e.jsx("section",{className:"py-20 bg-gradient-to-r from-emerald-600 to-slate-700",children:e.jsx("div",{className:"container mx-auto px-4 max-w-4xl text-center",children:e.jsxs(h.div,{initial:{opacity:0,y:40},whileInView:{opacity:1,y:0},transition:{duration:.6},viewport:{once:!0},children:[e.jsx("h2",{className:"text-4xl md:text-5xl font-bold text-white mb-6",children:"Audit Your Contract's Authorization Security"}),e.jsx("p",{className:"text-xl text-emerald-100 mb-8 max-w-2xl mx-auto",children:"Our AI-powered scanner instantly detects tx.origin vulnerabilities and provides secure authorization implementation guidance."}),e.jsxs("div",{className:"flex flex-col sm:flex-row gap-4 justify-center",children:[e.jsx(n,{href:"/signup",children:e.jsx(h.div,{whileHover:{scale:1.05,y:-2},whileTap:{scale:.95},transition:{type:"spring",stiffness:400},children:e.jsxs(p,{size:"lg",variant:"secondary",className:"bg-white text-emerald-700 hover:bg-emerald-50 text-lg px-8 py-4","data-testid":"button-scan-authorization",children:["Scan Authorization",e.jsx(T,{className:"w-5 h-5 ml-2"})]})})}),e.jsx(n,{href:"/smart-contract-audit",children:e.jsx(h.div,{whileHover:{scale:1.05,y:-2},whileTap:{scale:.95},transition:{type:"spring",stiffness:400},children:e.jsx(p,{size:"lg",variant:"outline",className:"border-2 border-white text-white hover:bg-white hover:text-emerald-700 text-lg px-8 py-4","data-testid":"button-security-audit",children:"Get Security Audit"})})})]}),e.jsx("p",{className:"text-emerald-200 text-sm mt-6",children:"Free authorization scan ⢠Instant tx.origin detection ⢠Secure patterns included"})]})})})]})}export{X as default};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.