The vulnerability was extremely simple, as suggested by the three keyword-long patch. I've written about this and other Solidity/EVM bugs from a technical perspective, if anybody is curious:
I think at least a big part of the solution to these security problems is two-fold:
- More secure conventions. All of the gotchas in Solidity make for a bad time. Even non-security bugs create a bad developer experience. Opting into private functions by default
- More code review. Engineers need to be diligent or hire security professionals who are (I'm one).
- https://ericrafaloff.com/parity-multi-sig-contract-vulnerabi...
- https://ericrafaloff.com/analyzing-the-erc20-short-address-a...
I think at least a big part of the solution to these security problems is two-fold:
- More secure conventions. All of the gotchas in Solidity make for a bad time. Even non-security bugs create a bad developer experience. Opting into private functions by default
- More code review. Engineers need to be diligent or hire security professionals who are (I'm one).