I wrote this attack up last week -- a solidity dev initially noticed this bug, but seemed to think it wasn't a big deal. http://vessenes.com/more-ethereum-attac

I wrote this attack up last week -- a solidity dev initially noticed this bug, but seemed to think it wasn't a big deal. http://vessenes.com/more-ethereum-attacks-race-to-empty-is-the-real-deal/ http://vessenes.com/more-ethereum-attacks-race-to-empty-is-t... The comments here are generally spot on; it's a combination of problems -- upgradability is designed to be hard because other people's money shouldn't be easy to steal, programmers are not used to making whole programs reentrant, existing documentation underplays risks, or alternately just tells people to do the wrong thing. A better language would help, better documentation would help, better standards about how to write the programs would also help. And, of course, more eyes are helpful. I'm an outsider to Ethereum, and got a very polite response, overall the community has been great. That said, there just aren't enough people looking at these contracts right now.