Submission Details
Severity:
Potential use of tx.origin for authentication.
Summary
Using tx.origin may lead to problems when users are interacting via smart contract with your protocol. It is recommended to use msg.sender for authentication.
Vulnerability Details
Found in contracts/GmxProxy.sol ``Line: 352
require(tx.origin == owner(), "not owner");
Impact
Vulnerability to phishing attack
Potential contract manipulation through malicious intermediate contracts
Authentication bypass risks
Recommendations
Replace all tx.origin usage with msg.sender
Implement proper authentication checks
Add additional security layers for critical functions
Consider using OpenZeppelin's authentication patterns
Updates
Lead Judging Commences
n0kto 3 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
invalid_tx-origin
Lightchaser: Medium-5
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
1,91026 USDC / LOC
47,500
2,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.