This function will reduce user balances, before the vulnerable withdraw function is called. So, instead of the logging function, we should have: if (!transfer(0 , balances[msg.sender])) { throw; } This would .... also reduce the tokens available to the user later on The more I think of the typo and the explanation about it in that article, the more unclear I am about that whole code. Keeping aside this hack, for a mo…
No, because after the call to Transfer() and withdrawRewardFor(), it sets their balance to zero:
totalSupply -= balances[msg.sender];
balances[msg.sender] = 0;
paidOut[msg.sender] = 0;
In fact, to me it doesn't look like there's a typo at all there - the call to Transfer() was fully intended just to log the burning of the tokens that will be accomplished by the later lines setting the balance to zero. The bug is simply that the balance isn't adjusted before the attacker gets a chance to execute code.