<story><title>Deconstructing the DAO Attack: A Brief Code Tour</title><url>http://vessenes.com/deconstructing-thedao-attack-a-brief-code-tour/</url></story><parent_chain><item><author>winteriscoming</author><text>The apparent typo is odd, IMO. I don&amp;#x27;t know the language in which that program is written, but looking at that snippet, &amp;quot;Transfer&amp;quot; takes 3 arguments whereas the &amp;quot;transfer&amp;quot; function takes 2 arguments.  Isn&amp;#x27;t there any code review involved when this makes into the codebase. Assuming there was some code review and the reviewer just missed it (which is very much possible), a basic unit test case would have easily caught this bug, isn&amp;#x27;t it? After all, the test case would have checked for the balance etc...  after execution of these functions. Aren&amp;#x27;t there any test cases around this?</text></item></parent_chain><comment><author>vessenes</author><text>I think after sleeping on it that I agree with you, this is more likely the outcome of bad refactoring. You can read the code commits on github if you like; I don&amp;#x27;t have them handy, unfortunately.&lt;p&gt;transfer is a very poorly named function, of that there is no doubt. And Transfer is badly named as well.&lt;p&gt;transferAndLockTokens vs LogTransfer would be much, much better.</text></comment>
<story><title>Deconstructing the DAO Attack: A Brief Code Tour</title><url>http://vessenes.com/deconstructing-thedao-attack-a-brief-code-tour/</url></story><parent_chain><item><author>winteriscoming</author><text>The apparent typo is odd, IMO. I don&amp;#x27;t know the language in which that program is written, but looking at that snippet, &amp;quot;Transfer&amp;quot; takes 3 arguments whereas the &amp;quot;transfer&amp;quot; function takes 2 arguments.  Isn&amp;#x27;t there any code review involved when this makes into the codebase. Assuming there was some code review and the reviewer just missed it (which is very much possible), a basic unit test case would have easily caught this bug, isn&amp;#x27;t it? After all, the test case would have checked for the balance etc...  after execution of these functions. Aren&amp;#x27;t there any test cases around this?</text></item></parent_chain><comment><author>rrradical</author><text>Test cases...code review... How about type checking??&lt;p&gt;The idea of writing financial software without taking every available precaution to verify correctness is insane to me.</text></comment>