The Dao 攻击

// Deployed on mainnet at 0xbf4ed7b27f1d666546e30d74d50d173d20bca754

contract DAO {
    function balanceOf(address addr) returns (uint);
    function transferFrom(address from, address to, uint balance) returns (bool);
    uint public totalSupply;
}

contract WithdrawDAO {
    DAO constant public mainDAO = DAO(0xbb9bc244d798123fde783fcc1c72d3bb8c189413);
    address public trustee = 0xda4a4626d3e16e094de3225a751aab7128e96526;

    function withdraw(){
        uint balance = mainDAO.balanceOf(msg.sender);

        if (!mainDAO.transferFrom(msg.sender, this, balance) || !msg.sender.send(balance))
            throw;
    }

    function trusteeWithdraw() {
        trustee.send((this.balance + mainDAO.balanceOf(this)) - mainDAO.totalSupply());
    }
}

// params/config.go:38
MainnetChainConfig = &ChainConfig{ 
		DAOForkBlock:        big.NewInt(1920000),
		DAOForkSupport:      true, 
	}

//params/dao.go:28
var DAOForkBlockExtra = common.FromHex("0x64616f2d686172642d666f726b")

// params/dao.go:32
var DAOForkExtraRange = big.NewInt(10)

// miner/worker.go:857
if daoBlock := w.config.DAOForkBlock; daoBlock != nil { 
    // 检查是否区块是否仍然属于分叉处理期间：[DAOForkBlock,DAOForkBlock+10)
	limit := new(big.Int).Add(daoBlock, params.DAOForkExtraRange)
	if header.Number.Cmp(daoBlock) >= 0 && header.Number.Cmp(limit) < 0 { 
        // 如果支持分叉，则覆盖Extra，写入保留的投票信息
		if w.config.DAOForkSupport {
			header.Extra = common.CopyBytes(params.DAOForkBlockExtra)
		} else if bytes.Equal(header.Extra, params.DAOForkBlockExtra) {
            // 如果矿工反对，则不能让其使用保留信息，覆盖它。
			header.Extra = []byte{}  
		}
	}
}

// consensus/ethash/consensus.go:294 
if err := misc.VerifyDAOHeaderExtraData(chain.Config(), header); err != nil { //❶
	return err
} 

// consensus/misc/dao.go:47 
func VerifyDAOHeaderExtraData(config *params.ChainConfig, header *types.Header) error { 
	if config.DAOForkBlock == nil {//❷
		return nil
	}
	limit := new(big.Int).Add(config.DAOForkBlock, params.DAOForkExtraRange) //❸
	if header.Number.Cmp(config.DAOForkBlock) < 0 || header.Number.Cmp(limit) >= 0 {
		return nil
	}
	if config.DAOForkSupport {
		if !bytes.Equal(header.Extra, params.DAOForkBlockExtra) { //❹
			return ErrBadProDAOExtra
		}
	} else {
		if bytes.Equal(header.Extra, params.DAOForkBlockExtra) {//❺
			return ErrBadNoDAOExtra
		}
	}
	// All ok, header has the same extra-data we expect
	return nil
}

// eth/handler.go:300
	p.forkDrop = time.AfterFunc(daoChallengeTimeout, func() {
		p.Log().Debug("Timed out DAO fork-check, dropping")
		pm.removePeer(p.id)
	})

// eth/handler.go:297
	if err := p.RequestHeadersByNumber(daoBlock.Uint64(), 1, 0, false); err != nil {
		return err
	}

// eth/handler.go:348
	case msg.Code == GetBlockHeadersMsg:  
		var query getBlockHeadersData
		if err := msg.Decode(&query); err != nil {
			return errResp(ErrDecode, "%v: %v", msg, err)
		}
		hashMode := query.Origin.Hash != (common.Hash{})
		first := true
		maxNonCanonical := uint64(100) 
		var (
			bytes   common.StorageSize
			headers []*types.Header
			unknown bool
		)
		//省略一部分 ...
		return p.SendBlockHeaders(headers)

// eth/handler.go:465
if p.forkDrop != nil && pm.chainconfig.DAOForkBlock.Cmp(headers[0].Number) == 0 { 
				p.forkDrop.Stop()
				p.forkDrop = nil
 
				if err := misc.VerifyDAOHeaderExtraData(pm.chainconfig, headers[0]); err != nil {
					p.Log().Debug("Verified to be on the other side of the DAO fork, dropping")
					return err
				}
				p.Log().Debug("Verified to be on the same side of the DAO fork")
				return nil
			}

// eth/handler.go:442 
if len(headers) == 0 && p.forkDrop != nil { 
	verifyDAO := true

	if daoHeader := pm.blockchain.GetHeaderByNumber(pm.chainconfig.DAOForkBlock.Uint64()); daoHeader != nil {
		if _, td := p.Head(); td.Cmp(pm.blockchain.GetTd(daoHeader.Hash(), daoHeader.Number.Uint64())) >= 0 {
			verifyDAO = false
		}
	} 
	if verifyDAO {
		p.Log().Debug("Seems to be on the same side of the DAO fork")
		p.forkDrop.Stop()
		p.forkDrop = nil
		return nil
	}
}

// miner/worker.go:877
func (w *worker) commitNewWork(interrupt *int32, noempty bool, timestamp int64) {
	// ...
// Create the current work task and check any fork transitions needed
	env := w.current
	if w.config.DAOForkSupport && w.config.DAOForkBlock != nil && w.config.DAOForkBlock.Cmp(header.Number) == 0 {
		misc.ApplyDAOHardFork(env.state)
	}
	// ...
}	

// core/state_processor.go:66
func (p *StateProcessor) Process(block *types.Block, statedb *state.StateDB, cfg vm.Config) (types.Receipts, []*types.Log, uint64, error) {
	//...
	// Mutate the block and state according to any hard-fork specs
	if p.config.DAOForkSupport && p.config.DAOForkBlock != nil && p.config.DAOForkBlock.Cmp(block.Number()) == 0 {
		misc.ApplyDAOHardFork(statedb)
	}
	//...
}	

func ApplyDAOHardFork(statedb *state.StateDB) {
	// Retrieve the contract to refund balances into
	if !statedb.Exist(params.DAORefundContract) {
		statedb.CreateAccount(params.DAORefundContract)
	}

	// Move every DAO account and extra-balance account funds into the refund contract
	for _, addr := range params.DAODrainList() {
		statedb.AddBalance(params.DAORefundContract, statedb.GetBalance(addr))
		statedb.SetBalance(addr, new(big.Int))
	}
}