# M09-L02 — Lab contract

**Build:** Write negative tests for tx.origin design and signature replay.

**Pass:** Unauthorized calls revert; reused signed authorization rejected.

**Failure injection:** tx.origin auth and missing domain separation invite misuse.

**Review question:** Why should signatures include deadline and nonce?

Status: specification; only count as executable when source and tests are present and verified.