Transfer ERC20 tokens using another contract. tx.origin vs msg.sender

Question

I have a basic ERC20 token(TMP coin) contract like mentioned in ERC20 Token example.

In ERC20 token example code transfer function transferring tokens from msg.sender to another account, but why we are not using tx.origin?

How can I transfer TMP coin tokens from one account to another by using another smart contract(contract XYZ)?

Answer 1

tx.origin vs msg.sender:

msg.sender - the address of the direct caller (can be contract or externally owned account)

tx.origin - the address of the caller the transaction originates from (always an externally owned account).

It is best practice to not use tx.origin unless you really need to know the origin.

You should not use tx.origin for verification as that would expose you to potential attacks (tx.origin attack). The example in the Solidity docs is outdated and can't be reproduced with .transfer() anymore but there are ways around it.

Transfer ERC20 from A to B:

In order to transfer tokens from account A to account B using Contract C you would need to do the following:

1. From A call the ERC20 function approve(address _spender, uint256 _value) and pass the address of C as spender, plus the amount he is allowed to send. This would tell the Token Contract that your contract C is allowed to transfer the specified amount from your address A.

2. From C call the ERC20 function transferFrom(address _from, address _to, uint256 _value). Passing in from: A.address and to: B.address

Answer 2

msg.sender can be a Contract address as well, while tx.origin is always an EOA. http://ethdocs.org/en/latest/contracts-and-transactions/account-types-gas-and-transactions.html#eoa-vs-contract-accounts

Using msg.sender allows contracts to receive funds from other contract accounts as opposed to just EOAs.