4 ms·
I'm not expert on etherium code (just started looking at it now) but it looks like the DAO didn't look for similar issues with the latest security fix. https:/
by benmmurphy 10y ago
I'm not expert on etherium code (just started looking at it now) but it looks like the DAO didn't look for similar issues with the latest security fix.
https://github.com/slockit/DAO/commit/f01f3bd8df5e1e222dde625118b7e0f2bfe5b680 https://github.com/slockit/DAO/commit/f01f3bd8df5e1e222dde62...
reward = rewardAccount.balance < reward ? rewardAccount.balance : reward;
+ paidOut[_account] += reward;
if (!rewardAccount.payOut(_account, reward))
throw;
- paidOut[_account] += reward;
+
return true;
}
but if you grep payOut then you see a similar broken pattern where it modifies the state after the call instead of before it.
if(_toMembers) {
if (!DAOrewardAccount.payOut(dao.rewardAccount(), reward))
throw;
}
else {
if (!DAOrewardAccount.payOut(dao, reward))
throw;
}
DAOpaidOut[msg.sender] += reward;
but apparently this is not how the DAO is being drained because there are no rewards at the moment.
this is a good summary of the problem:
https://blog.ethereum.org/2016/06/10/smart-contract-security/ https://blog.ethereum.org/2016/06/10/smart-contract-security...
and should scare you about the security of smart contracts base on etherium.
EDIT: mm.. maybe it is safe because the addresses dao/dao.rewardAccount() can't be controlled by attackers