This bug:
https://www.reddit.com/r/ethereum/comments/4nmohu/from_the_maker_dao_slack_today_we_discovered_a/
Is also present in theDAO code - specifically here in the withdrawRewardFor function DAO.sol:
if (!rewardAccount.payOut(_account, reward))
throw;
paidOut[_account] += reward;
return true;
and here in managedAccount.sol
function payOut(address _recipient, uint _amount) returns (bool) {
if (msg.sender != owner || msg.value > 0 || (payOwnerOnly && _recipient != owner))
throw;
if (_recipient.call.value(_amount)()) {
PayOut(_recipient, _amount);
return true;
} else {
return false;
}
}
This would allow a user to drain many times his entitlement by calling the contract recursively. Oddly enough the slockit team spotted this bug here in the proposal section:
// we are setting this here before the CALL() value transfer to
// assure that in the case of a malicious recipient contract trying
// to call executeProposal() recursively money can't be transferred
// multiple times out of the DAO
p.proposalPassed = true;
but missed it in the reward section.Obviously there are not yet any rewards in theDAO so this is not an issue that could cost money today.
The DAO