Submission Details
Severity:
Potential use of `tx.origin` for authentication
Summary:
Use of tx.origin for authentication in GmxProxy:setPrepVault which set the transaction address instead of owner
Vulnerability Details:
- Found in contracts/GmxProxy.sol [Line: 352](contracts/GmxProxy.sol#L352)
require(tx.origin == owner(), "not owner");
Impact:
Using `tx.origin` may lead to problems when users are interacting via smart contract with your protocol
Tools Used:
Manual review+aderyn+slither
Recommendations:
It is recommended to use msg.sender for authentication instead of tx.origin
- require(tx.origin == owner(), "not owner");
+ require(msg.sender == owner(), "not owner");
Updates
Lead Judging Commences
n0kto 7 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
invalid_tx-origin
Lightchaser: Medium-5
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
1,91026 USDC / LOC
47,500
2,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.