Could msg.sender be changed by a hacker?

Question

I was researching the msg object and I could not find out very much about how it is created. It seems to be that contracts depend on checking owner == msg.sender. That is dependent on msg.sender being secure.

Could someone simply alter msg.sender in an hacking attempt? How is the object actually transmitted?

It seems to me the point of any communication of data from one point to another will depend on somekind check at both ends that the data has not been changed.

If someone could change msg.sender then they could simply destroy many contracts or pretend to be the owner and mint new tokens.

I saw this - http://solidity.readthedocs.io/en/develop/security-considerations.html

It refers to hacking the slots when the full 32 bytes are not used. I think msg.sender uses the full slot anyway, so that is not an issue.

Answer 1

msg.sender is recovered from the transaction signature. Assuming the signature scheme used by Ethereum works as intended, it should only be possible to create the signature for a given address if you have the private key to that address.

Stealing private keys is very common, so any contract that gives power for token creation etc to a particular key is only as secure as the security with which that key is being stored and managed.