Using “origin" parameter may be a vulnerability

[noel2004]

Currently some function (addToken and depositETH) in FluidexDemo contract has induced a "origin" parameter for being called from delegator contract. When called inside the delegator contract, the msg.sender of delegator contract it passed and being considered as the "original caller" of such an action. Such a practice may become problematic because:

1. The method which accepts origin argument has no ability to check if it was passed by expected: in case a malicious contract or address has been assigned with delegator role, they can forge any address which can pass the privilege checking of origin argument inside these methods.

2. The msg.sender is not the real tx caller if the delegator contract is called from another contract or proxy. In this case, the privilege checking is failed even a user with required privilege really call them.

There is tx.origin in solidity which indicate the sender of the transaction for the full calling chain. Maybe we should use the variant rather an additional "origin" parameter?