noexploit.js

include "List.aes"

contract SomeBasicToken =
  record state = {   
   balances: map(address, int)} // define map for balances
   
  stateful entrypoint init() : state = {
    balances = {[Call.caller] = 1337}} // give the deployer some tokens

  
  stateful entrypoint batch_transfer(receivers : list(address), value : int) =
   let count = List.length(receivers)
   let amount = count * value // <-------------- potential overflow here
   let balance = state.balances[Call.caller]
   require(count > 0 && count =< 20, "incorrect count")
   // bypassable security check in next line:
   require(value > 0 && balance >= amount, "incorrect value or balance")

   // subtract tokens from sender
   let substracted_balance = state.balances{ [Call.caller] = balance - amount}
   put(state{ balances = substracted_balance })
   
   // helpfer function to add tokens to recipients' balance
   let add_balance_function =
    (receiver) =>
      let receiver_balance = state.balances[receiver]
      let added_balance = state.balances{ [receiver] = receiver_balance + value}
      put(state{ balances = added_balance })
   
   // add tokens to recipients' balance
   List.map(add_balance_function, receivers)