Telephone

Claim ownership of the contract below to complete this level.

You might want to check how tx.origin (opens new window) is different from msg.sender.

// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;

contract Telephone {

  address public owner;

  constructor() public {
    owner = msg.sender;
  }

  function changeOwner(address _owner) public {
    if (tx.origin != msg.sender) {
      owner = _owner;
    }
  }
}

TIP

This example (opens new window) demonstrates the differences between tx.origin and msg.sender.

While this example may be simple, confusing tx.origin with msg.sender can lead to phishing-style attacks, such as this (opens new window).

An example of a possible attack is outlined below.

1. Use tx.origin to determine whose tokens to transfer, e.g.

function transfer(address _to, uint _value) {
  tokens[tx.origin] -= _value;
  tokens[_to] += _value;
}

2. Attacker gets victim to send funds to a malicious contract that calls the transfer function of the token contract, e.g.

function () payable {
  token.transfer(attackerAddress, 10000);
}

3. In this scenario, tx.origin will be the victim's address (while msg.sender will be the malicious contract's address), resulting in the funds being transferred from the victim to the attacker.

You can also solve the "Call Me Maybe" challenge (opens new window) from etherhack!