浅析AMR智能合约批量转账溢出漏洞

  /*** @dev Function is used to perform a multi-transfer operation. 
  This could play a significant role in the Ammbr Mesh Routing protocol.     
  ** Mechanics:     
  * Sends tokens from Sender to destinations[0..n] the amount tokens[0..n]. 
  Both arrays     
  * must have the same size, and must have a greater-than-zero length. 
  Max array size is 127.     
  ** IMPORTANT: ANTIPATTERN     
  * This function performs a loop over arrays. 
  Unless executed in a controlled environment,     
  * it has the potential of failing due to gas running out. 
  This is not dangerous, yet care     
  * must be taken to prevent quality being affected.     
  ** @param destinations An array of destinations we would be sending tokens to     
  * @param tokens An array of tokens, sent to destinations (index is used for destination->token match)  
  */function multiTransfer(address[] destinations, uint[] tokens) public returns (bool success){        
 // Two variables must match in length, and must contain elements       
 // Plus, a maximum of 127 transfers are supported       
 assert(destinations.length > 0);        
 assert(destinations.length < 128);        
 assert(destinations.length == tokens.length);        
 // Check total requested balance        
 uint8 i = 0;       
 uint totalTokensToTransfer = 0;       
 for (i = 0; i < destinations.length; i++){assert(tokens[i] > 0);totalTokensToTransfer += tokens[i]; }        
 // Do we have enough tokens in hand?        
 assert (balances[msg.sender] > totalTokensToTransfer);       
 // We have enough tokens, execute the transfer        
 balances[msg.sender] = balances[msg.sender].sub(totalTokensToTransfer);        
 for (i = 0; i < destinations.length; i++){           
 // Add the token to the intended destination            
 balances[destinations[i]] = balances[destinations[i]].add(tokens[i]);            
 // Call the event...            
 emit Transfer(msg.sender, destinations[i], tokens[i]); } return true;    }

function multiTransfer(address[] recipients, uint256[] amounts) public {    
require(recipients.length == amounts.length);   
 for (uint i = 0; i < recipients.length; i++) {        
 transfer(recipients[i], amounts[i]);    }}

 /// @title Gnosis token contract/// 
 @author Stefan George - 
 <stefan.george@consensys.net>contract GnosisToken is StandardToken
  {    /*     *  Token meta data     */    string constant public name 
 = "Gnosis Token";    string constant public symbol = "GNO";   
 uint8 constant public decimals = 18;    /*     *  Public functions     */   
 /// @dev Contract constructor function sets dutch auction 
 contract address and assigns all tokens to dutch auction.    
 /// @param dutchAuction Address of dutch auction contract.   
  /// @param owners Array of addresses receiving preassigned tokens.    
  /// @param tokens Array of preassigned token amounts.    
  function GnosisToken(address dutchAuction, address[] owners, uint[] tokens)      
  public    {        if (dutchAuction == 0)            // Address should not be null.            
  throw;        totalSupply = 10000000 * 10**18;        
  balances[dutchAuction] = 9000000 * 10**18;        
  Transfer(0, dutchAuction, balances[dutchAuction]);       
  uint assignedTokens = balances[dutchAuction];       
  for (uint i=0; i<owners.length; i++) {            if (owners[i] == 0)               
  // Address should not be null.                throw;            
  balances[owners[i]] += tokens[i];            Transfer(0, owners[i], tokens[i]);            
  assignedTokens += tokens[i];        }        if (assignedTokens != totalSupply)            
  throw;    }}

 function batchTransfer(address[] _to, uint[] _value) checkAccess
 ("currencyOwner") returns (bool) {        if (_to.length != _value.length) {           
 Error(7, tx.origin, msg.sender);            return false;        }        
 uint totalToSend = 0;        for (uint8 i = 0; i < _value.length; i++) {            
 totalToSend += _value[i];        }        ElcoinDb db = _db();        
 if (db.getBalance(msg.sender) < totalToSend) {            
 Error(8, tx.origin, msg.sender);            return false;        }        
 db.withdraw(msg.sender, totalToSend, 0, 0);        
 for (uint8 j = 0; j < _to.length; j++) {            
 db.deposit(_to[j], _value[j], 0, 0);            
 Transfer(msg.sender, _to[j], _value[j]);        }        return true;    }

 function transferMulti(address[] _to, uint256[] _value)
 public returns (uint256 amount){        require(_to.length == _value.length);        
 uint8 len = uint8(_to.length);        for(uint8 j; j<len; j++){           
 amount += _value[j];        }        require(balanceOf[msg.sender] >= amount);       
 for(uint8 i; i<len; i++){            address _toI = _to[i];           
 uint256 _valueI = _value[i];            balanceOf[_toI] += _valueI;            
 balanceOf[msg.sender] -= _valueI;            
 Transfer(msg.sender, _toI, _valueI);        }    }