Mastering Blockchain Programming with Solidity

Avoid using tx.origin for authorization

The msg.sender global variable gives the address of the caller of the function. The tx.origin is also a globally available variable that returns the address of the transaction initiator. For example, using an EOA account; Alice initiates a transaction to Contract-A which further makes a function call to a Contract-B. Then the function present in Contract-B would give the address of the Contract-A when msg.sender is evaluated; however, when tx.origin is evaluated in the same function, it would return the address of Alice's EOA, because Alice is the original transaction initiator.

The tx.origin method should not be used as authorization for any function. The access control protected using tx.origin can ...