A 732-byte merchant metadata holder: the deployer stores an arbitrary string that anyone can read, and only the deployer can change it.
Historical Significance
A compact example of the tx.origin authorisation pattern that was ordinary in 2015 and is now a standard audit finding. Because the check looks at the transaction's originating account rather than the immediate caller, any contract the merchant is persuaded to interact with can call setMeta on their behalf. The same idiom appears in the multi-signature wallet of the same period, where it was forced by CALLCODE; here it is simply how access control was written.
Context
Deployed 2015-09-25 by 0xec61e51660f3cefaa16d17500542b5b7b3971b92. Three byte-identical copies of this runtime exist. Source recovered by exact runtime bytecode match, verified on Sourcify and Etherscan. The crack turned on ORIGIN rather than CALLER appearing in the guard: every other candidate matched to 442 of 732 bytes.
Key Facts
Description
Storage is a merchant address in slot 0 and a string in slot 1. getMerchant() returns the address, getMeta() returns the string, and setMeta(string) overwrites the string after checking the caller. The guard is written against tx.origin rather than msg.sender, so authorisation follows the externally owned account that started the transaction and passes through any intermediate contract that relays the call.
Source Verified
Heuristic Analysis
The following characteristics were detected through bytecode analysis and may not be accurate.
Frontier Era
The initial release of Ethereum. A bare-bones implementation for technical users.
Bytecode Overview
Verified Source Available
Source verified through compiler archaeology and exact bytecode matching.
View Verification ProofShow source code (Solidity)
// Submitted by EthereumHistory (ethereumhistory.com)
contract Meta {
address merchant;
string meta;
function Meta() { merchant = msg.sender; }
function getMerchant() constant returns (address) { return merchant; }
function setMeta(string _meta) {
if (tx.origin != merchant) { return; }
meta = _meta;
}
function getMeta() constant returns (string) { return meta; }
}External Links
Related contracts
Contract 0x3b33fd...67cc6e
Same deployerA 2015 public key directory that keys every entry off tx.origin instead of msg.sender.
0x3b33fd...67cc6eSeptember 25, 2015Contract 0x68656b...099a3c
Same deployerA 2015 public key directory that keys every entry off tx.origin instead of msg.sender.
0x68656b...099a3cSeptember 25, 2015Contract 0xb1cae1...3af281
Same deployerA 2015 public key directory that keys every entry off tx.origin instead of msg.sender.
0xb1cae1...3af281September 25, 2015Contract 0xd0f28a...a2b650
Same deployerA 2015 public key directory that keys every entry off tx.origin instead of msg.sender.
0xd0f28a...a2b650September 25, 2015Contract 0x6fe164...c7ef7a
Same deployerA 2015 public key directory that keys every entry off tx.origin instead of msg.sender.
0x6fe164...c7ef7aSeptember 25, 2015KeyRegistry
Same deployerA 2015 public key directory that keys every entry off tx.origin instead of msg.sender.
0x016c93...befc1aSeptember 25, 2015