3 ms·

If I understood the explanation on that article correctly, what's even more interesting is that this typo apparently hasn't yet been fixed in the repos (assumin

If I understood the explanation on that article correctly, what's even more interesting is that this typo apparently hasn't yet been fixed in the repos (assuming I'm looking at the right ones). There are 2 repos which I looked at: https://github.com/slockit/DAO https://github.com/slockit/DAO https://github.com/TheDAO/DAO-1.0 https://github.com/TheDAO/DAO-1.0 I don't know which one is the authoritative one. But the interesting bit is both these repos still have that same typo in the master branch: https://github.com/TheDAO/DAO-1.0/blob/master/DAO.sol#L666 https://github.com/TheDAO/DAO-1.0/blob/master/DAO.sol#L666 (the other repo) https://github.com/slockit/DAO/blob/develop/DAO.sol#L685 https://github.com/slockit/DAO/blob/develop/DAO.sol#L685 The slockit account repo has a commit which was made 6 days back, with the commit message "Protect against recursive withdrawRewardFor attack" https://github.com/slockit/DAO/commit/f01f3bd8df5e1e222dde625118b7e0f2bfe5b680 https://github.com/slockit/DAO/commit/f01f3bd8df5e1e222dde62... but it doesn't fix the typo and there aren't any more commit in there after that one. Does this mean, the upstream repos containing the typo haven't yet been fixed? Or am I just looking at the wrong repos/branches? Or did this typo get known only a few hours back?

jstolfi 10y ago
> this typo apparently hasn't yet been fixed in the repos IIUC, once an Ethereum program is started, it cannot be killed or fixed. If so, updating the gitbub repo would be pointless at this time.
- Natanael_L 10y ago
  If it has a provision for forwarding all assets (with the necessary internal state detailed) to another address/DAO, then you can basically perform a migration to a fixed version.
  - josu 10y ago
    Or a malicious one. The move has to be voluntary.
  - csarva 10y ago
    There is no such provision. You can transfer the "balance" of a contract to another, but not any of it's internal state. This is left up to the programmer and AFAICT, they didn't implement this feature in the DAO contract(s).

jstolfi 10y ago

> this typo apparently hasn't yet been fixed in the repos IIUC, once an Ethereum program is started, it cannot be killed or fixed. If so, updating the gitbub repo would be pointless at this time.

Natanael_L 10y ago
If it has a provision for forwarding all assets (with the necessary internal state detailed) to another address/DAO, then you can basically perform a migration to a fixed version.
- josu 10y ago
  Or a malicious one. The move has to be voluntary.
- csarva 10y ago
  There is no such provision. You can transfer the "balance" of a contract to another, but not any of it's internal state. This is left up to the programmer and AFAICT, they didn't implement this feature in the DAO contract(s).