tx.origin in access control

[joanthecoder]

Can Slither detect issues related to unsafe use of tx.origin in access control? If so, how reliable is the detection?

[marceontech]

Yes, Slither can detect dangerous use of tx.origin via its tx-origin detector, which flags contracts that use tx.origin in sensitive logic (like access control).

The detection is quite reliable for common patterns, especially when used like:

require(tx.origin == owner, "Not authorized");

however, Slither will not catch all complex proxy patterns or complicated logic, so you should still review code manually.

As a best practice, always use msg.sender instead of tx.origin for access checks, since tx.origin can be faked through phishing contracts.

[joanthecoder]

Thanks, yes that confirms what the course says then