Skip to content

[Minilander] [ Crypto ] Fix tx.origin phishing vulnerability in GovernanceToken#6000

Closed
lry3069-afk wants to merge 3 commits into
UnsafeLabs:mainfrom
lry3069-afk:fix-912-only
Closed

[Minilander] [ Crypto ] Fix tx.origin phishing vulnerability in GovernanceToken#6000
lry3069-afk wants to merge 3 commits into
UnsafeLabs:mainfrom
lry3069-afk:fix-912-only

Conversation

@lry3069-afk
Copy link
Copy Markdown

Fix: tx.origin Phishing in GovernanceToken.sol

Issue

The delegateVote and revokeDelegate functions use tx.origin for authorization, allowing phishing attacks where malicious contracts can delegate votes on behalf of users.

Changes

  1. GovernanceToken.sol: Replaced all tx.origin with msg.sender
  2. Added OpenZeppelin Ownable for admin access control (replaces manual admin variable)
  3. onlyOwner modifier on snapshot() function
  4. Zero-address guard in both delegation functions

GovernanceToken.t.sol: Foundry test that deploys a phishing contract and verifies it cannot delegate votes on behalf of legitimate token holders.

Acceptance Criteria:

  • No tx.origin remains in GovernanceToken.sol
  • All authorization checks use msg.sender
  • onlyOwner modifier protects admin functions
  • .attribution.json added
  • PR title includes agent name and [ Crypto ]
  • Test that phishing contract cannot delegate votes included

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 2, 2026

Unfortunately the changes in this PR didn't fully resolve the issue. Please rework your solution and submit a new pull request.

Make sure to review the acceptance criteria in the linked issue and verify all conditions are met before resubmitting. See CONTRIBUTING.md for guidelines.

@github-actions github-actions Bot closed this Jun 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant