The Identity Crisis: tx.origin vs msg.sender 🎭

Explains the critical difference between tx.origin and msg.sender in Solidity smart contracts and how misusing tx.origin for access control creates a phishing vulnerability. When a contract uses tx.origin for authorization, an attacker can deploy a malicious contract that tricks the legitimate owner into initiating a transaction, which the attacker's contract then uses to call privileged functions on the target contract. The owner's wallet becomes an unwitting proxy, bypassing all access controls. The fix is simple: always use msg.sender for authorization, never tx.origin.