“I still think that splitDAO may have a vulnerability,” he wrote to his student. “It violates the withdraw pattern by not zeroing the balances field until after the call. So I think it may be possible to have it move rewardTokens to a splitting DAO multiple times. This is happening on lines 640 to 666 (hah!) of DAO.sol. Am I wrong?”
