Was throw part of DAO (attacked) code?

Question

I have attached a picture related to DAO attack. I got the image from the following link A Survey on Ethereum Systems Security: Vulnerabilities, Attacks and Defenses . The image shows a code containing ‘throw’. I have a confusion about throw because it causes reversal. Had the DOA attack used ‘throw’? Some body please guide me was throw used in the DAO attack and why it did not cause reversal of all transactions (and refunding)?

Answer 1

No.

If I understand the graph correctly, it is simply showing the contract checking the msg.sender.call.value(reward) result to make sure it worked and it intended to throw if the transfer was rejected, which was the right thing to do.

It didn't fail. It invoked the Attacker (success) and that gave the Attacker an opportunity to consider re-entering. The Attacker needed to watch the remaining gas to make sure it didn't run out from looping around, or everything would unwind.

When it decided to stop re-entering and just return, then the threads would drop through the Y path and subtract from balances[msg.sender]. That has no underflow protection, so the statement, as shown cannot fail. At worst, the msg.sender ends up with a gigantic balance which would be an opening for more mischief.

After that, no path to throw even though the diagram sorta makes it look like that there might be. The "missing" arrow is not an oversight. It might be more clear if they added an "end" block.

Hope it helps.