msg.sender - the address of the direct caller (can be contract or externally owned account)
tx.origin - the address of the caller the transaction originates from (always an externally owned account).
It is best practice to not use
tx.origin unless you really need to know the origin.
You should not use
tx.origin for verification as that would expose you to potential attacks (tx.origin attack). The example in the Solidity docs is outdated and can't be reproduced with
.transfer() anymore but there are ways around it.
Transfer ERC20 from A to B:
In order to transfer tokens from account A to account B using Contract C you would need to do the following:
From A call the ERC20 function
approve(address _spender, uint256 _value)
and pass the address of C as spender, plus the amount he is allowed to
send. This would tell the Token Contract that your contract C is allowed to transfer the specified amount from your address A.
From C call the ERC20 function
transferFrom(address _from, address _to, uint256 _value). Passing in
from: A.address and