Does putting p.executed = true after p.recipient.call() make this vulnerable to recursive calls?

function executeProposal(uint proposalNumber, bytes transactionBytecode) returns (int result) {
    Proposal p = proposals[proposalNumber];
    if (p.executed) throw;


    p.executed = true;

From ethereum.org/dao

  • 1
    What a terrible system.
    – Jeremy
    Commented Jun 18, 2016 at 20:48
  • 1
    It's not terrible. Ethereum is new and everyone is still learning how to program on it.
    – dor
    Commented Jun 18, 2016 at 21:38

1 Answer 1


the attacker would have to use a call in his wallets fallback function and call the function again so he will be able to detract the money within the same recursion call, before p.executed = true.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.