ctf_sec - Should not use of tx.origin track user address

[sherlock-admin4]

ctf_sec

Medium

Should not use of tx.origin track user address

Summary

the code use tx.origin to track the user address

Vulnerability Detail

example:

https://github.com/sherlock-audit/2024-08-velar-artha/blob/18ef2d8dc0162aca79bd71710f08a3c18c94a36e/gl-sherlock/contracts/core.vy#L241

user       : address   = tx.origin
  pool       : PoolState = self.POOLS.lookup(id)

  cf         : Fee       = self.PARAMS.static_fees(collateral0)
  fee        : uint256   = cf.fee
  collateral : uint256   = cf.remaining

  assert pool.base_token  == base_token , ERR_PRECONDITIONS
  assert pool.quote_token == quote_token, ERR_PRECONDITIONS
  assert collateral > 0                 , ERR_PRECONDITIONS
  assert fee > 0                        , ERR_PRECONDITIONS

  if long: assert ERC20(quote_token).transferFrom(user, self, collateral0), "ERR_ERC20"
  else   : assert ERC20(base_token).transferFrom(user, self, collateral0),  "ERR_ERC20"

  # transfer protocol fees to separate contract
  if long: assert ERC20(quote_token).transfer(self.COLLECTOR, fee), "ERR_ERC20"
  else   : assert ERC20(base_token).transfer(self.COLLECTOR, fee),  "ERR_ERC20"

Impact

multisig wallet has owner alice and bob

alice calls open position using the multisig wallet (genosis safe)

alice calls genosis safe contract calls the velar contract,

while alice expects the user is the safe wallet, alice is tx.origin and she open a position using her own account, not on the safe wallet.

also using tx.origin has other security issue and break all smart contract integration.

https://medium.com/coinmonks/smart-contract-security-tx-origin-authorization-attack-vectors-027730ae601d

and

sherlock-audit/2024-02-optimism-2024-judging#194

Code Snippet

https://github.com/sherlock-audit/2024-08-velar-artha/blob/18ef2d8dc0162aca79bd71710f08a3c18c94a36e/gl-sherlock/contracts/core.vy#L241

Tool used

Manual Review

Recommendation

pass in the original msg.sender inside the core contract instead of tx.origin to track address directly.

Duplicate of #82