marryinweb3/ERC721-520

`tx.origin` is easily used by phishing

Opened this issue · 0 comments

Once exploited, you will be married with a strange address and can't revert by yourself.

function mint(
address _addressA,
address _addressB,
ERC721_520Token.Sex _sexA,
ERC721_520Token.Sex _sexB,
bytes calldata _signatureB,
bytes32[] calldata _merkleProof
) external payable {
if (!isWhiteList(tx.origin, _merkleProof)) {
require(_getPrice() <= msg.value, NO_ENOUGH_ETH);
}

More: https://hackernoon.com/hacking-solidity-contracts-using-txorigin-for-authorization-are-vulnerable-to-phishing#%3A%7E%3Atext=About+%40kamilpolak-%2Ctx.%2Care+vulnerable+to+phishing+attacks.