2

I want to use a factory so that people can create a standardized contract. People should be able to transfer money directly by this creation which led me to the problem of the msg.sender during the exceution. I read that tx.origin has some security flaws but I wonder if this is also true just for the creation of contracts by a factory. Following example contract:

 pragma solidity ^0.4.0;

    contract Factory {

     address[] public contracts;

       function createContract () 
          payable 
          public 
       {
          Con newCon = (new Con).value(msg.value)();
          contracts.push(newCon);
       }

    }


    contract Con { 

     address owner;
     uint256 valueOwner
;

     function Con() 
        payable 
        public 
     { 
        owner = tx.origin;
        valueOwner = msg.value;
     } 

       function withdraw () 
          public
       {
          if(msg.sender == owner)
             msg.sender.transfer(valueOwner);
       }

    }

I do not see why tx.origin should do any harm here or am I missing some point?

2

Using tx.origin will create issues when the factory is called from within another contract.

Wallet (A) calls > multisig contract (B) > which calls your factory (C) > sub contract (D).

In this case the tx.origin is wallet A. In most cases users will expect the owner to actually be the multisig B contract, and not A.

To prevent this, just use msg.sender in the factory C, and pass it along to the new contract instance D, preferably in a second method call so people can easily use the etherscan code validator with no constructor parameters.

| improve this answer | |
  • This seems not to be a security flaw but rather an inconvenience for the user. But as you mention verification via etherscan, the user could do a verification of the factory's createContract() function and the Con's constructor code, no? – RobOnChain Apr 20 '18 at 8:23
  • 1
    It's not a security flaw, it's working as intended. The main constraint when architecting a new "smart contract" should be consistency. Your users have no idea of the difference between tx.origin and msg.sender, and probably never will. – Micky Socaci Apr 22 '18 at 4:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.