No, because after the call to Transfer() and withdrawRewardFor(), it sets their balance to zero: totalSupply -= balances[msg.sender]; balances[msg.sender]

No, because after the call to Transfer() and withdrawRewardFor(), it sets their balance to zero: totalSupply -= balances[msg.sender]; balances[msg.sender] = 0; paidOut[msg.sender] = 0; So the bug is only exposed if the recipient of the reward transfers out the balance during the execution of withdrawRewardFor(). In fact, to me it doesn't look like there's a typo at all there - the call to Transfer() was fully intended just to log the burning of the tokens that will be accomplished by the later lines setting the balance to zero. The bug is simply that the balance isn't adjusted before the attacker gets a chance to execute code.