Anyone reading [this article][1] on the attack vector and [this forum post][2] could have discovered that Ursium is wrongly confident because the split function calls the reward function. Then it would be easy to execute the attack for a mediocre `web3.js` developer. 


  [1]: http://hackingdistributed.com/2016/06/16/scanning-live-ethereum-contracts-for-bugs/
  [2]: https://forum.daohub.org/t/bug-discovered-in-mkr-token-contract-also-affects-thedao-would-allow-users-to-steal-rewards-from-thedao-by-calling-recursively/4947/5?u=ursium