Mastering Blockchain Programming with Solidity

Preventing an attack

You should not use tx.origin in your contract to check for the authorization. Always use msg.sender to check the authorization of the function calls:

modifier onlyAuthorized() {    //Good Practice    require(authorized == msg.sender);    _;}

In the preceding code, we are using msg.sender instead of tx.origin. This fixes the issue, and an attacker would not be able to perform the attack because msg.sender always returns the address of the previous caller in the call stack. In the previous attack scenario, msg.sender would return the address of AttackerContract; hence, authorization fails, and funds would not be sent to the attacker.