Transaction context (tx.origin vs msg.sender) in Blockchain / Solidity - Quick Revision & Key Differences

Recall & Review

beginner

What does msg.sender represent in a blockchain transaction?

msg.sender is the immediate address that called the current function. It can be a user or another contract.

beginner

What is tx.origin in a blockchain transaction?

tx.origin is the original external account (user) that started the transaction, regardless of how many contracts were called in between.

intermediate

Why is using tx.origin for authorization considered risky?

Because tx.origin points to the original user, a malicious contract can trick your contract by forwarding calls, making your contract trust the wrong sender.

intermediate

In a call chain: User → Contract A → Contract B, what does msg.sender equal inside Contract B?

Inside Contract B, msg.sender is Contract A's address, the immediate caller.

beginner

Which is safer to use for access control: msg.sender or tx.origin?

msg.sender is safer because it checks the immediate caller, reducing risks of phishing attacks through intermediate contracts.

What does tx.origin represent in a transaction?

A The original external account that started the transaction

B The immediate caller of the current function

C The contract address executing the code

D The miner who included the transaction

tx.origin always points to the original user who started the transaction.

Inside a contract, msg.sender is:

A The original user who started the transaction

B The blockchain network

C The contract owner

D The immediate caller of the function

msg.sender is the address that directly called the current function.

Why should you avoid using tx.origin for authorization checks?

A It is slower to access

B It can be tricked by malicious contracts forwarding calls

C It can be spoofed by miners

D It does not exist in smart contracts

Malicious contracts can forward calls, making tx.origin unreliable for secure authorization.

In a call chain User → Contract A → Contract B, what is msg.sender inside Contract B?

A User address

B Transaction origin address

C Contract A address

D Contract B address

msg.sender is always the immediate caller, here Contract A.

Which is the best practice for checking who called your contract for security?

A Use <code>msg.sender</code>

B Use <code>tx.origin</code>

C Use the miner's address

D Use a random address

msg.sender is safer and recommended for authorization checks.

Explain the difference between tx.origin and msg.sender in a blockchain transaction.

Think about who started the transaction versus who called the current function.

Why is it risky to use tx.origin for authorization in smart contracts?

Consider how calls can be forwarded through multiple contracts.