Submission Details
Severity:
Dangerous Usage of tx.origin for authentication leads to
Summary
tx.origin-based protection can be abused by a malicious contract if a legitimate user interacts with the malicious contract.
Vulnerability Details
Using tx.origin may lead to problems when users are interacting via smart contract with GmxProxy protocol. In GmxProxy::setPerpVaultbe used
require(tx.origin == owner(), "not owner");
to validate the owner. However if owner is interacting with some malicious protocol if can lead to a problem
Tools Used
aderyn
Recommendations
use msg.senderin place of tx.origin
Updates
Lead Judging Commences
n0kto 8 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
invalid_tx-origin
Lightchaser: Medium-5
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
1,91026 USDC / LOC
47,500
2,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.