tx.origin alternative

Question

I couldn't find an appropriate, simple fix of the tx.origin vulnerability, without having to use any modifier, any help is very much appreciated,

thanks,

PS: msg.sender is not what I'm looking for (if another contract calls your contract msg.sender will be the address of the contract and not the address of the user who called the contract)

contract Proxy {

    address myAddress;

    function callMyContract() public view returns(address) {
        MyContract(myAddress).doSomthing();
    }
}

contract MyContract {

    event Something(address sender);

    function doSomthing() public (address) {
        emit Something(msg.sender); // Proxy address
        emit Something(tx.origin); // User address (the one I need) but vulnerable
    }
}

Answer 1

The vulnerabilities with tx.origin are from its semantics themselves, so there is no direct alternative. The common advice is to design your contract in a way that does not need tx.origin.

From: https://github.com/ethereum/solidity/issues/683:

1. tx.origin is a security vulnerability. As we recently saw with the Mist wallet, using tx.origin makes you vulnerable to attacks comparable to phishing or cross-site scripting. Once a user has interacted with a malicious contract, that contract can then impersonate the user to any contract relying on tx.origin.

2. tx.origin breaks compatibility. Using tx.origin means that your contract cannot be used by another contract, because a contract can never be the tx.origin. This breaks the general composability of Ethereum contracts, and makes them less useful. In addition, this is another security vulnerability, because it makes security-based contracts like multisig wallets incompatible with your contract.

3. tx.origin is almost never useful. This is the most subjective point, but I have yet to come across a use of tx.origin that seemed legitimate to me. I welcome counter-examples, but I've written dozens or hundreds of smart contracts without needing it, and I have never heard of anyone else needing it either.

If you need tx.origin to check if a call is coming from a smart contract, you can use something like:

function isContract(address _addr) private returns (bool isContract){
  uint32 size;
  assembly {
    size := extcodesize(_addr)
  }
  return (size > 0);
}

Other Resources

• Explanation of tx.origin attacks
• Difference between msg.sender and tx.origin