What does TheDAO counter-attack by spamming actually do? (suggested by Stephan Tual)

Question

TheDAO is currently under attack and a counter-attack by spam has been suggested by Stephan Tual https://blog.slock.it/dao-security-advisory-live-updates-2a0a42a2d07b#.r3wg8cxlw

What does this code actually do?

for (var i = 0; i < 100; i++) { 
    eth.sendTransaction({from: eth.accounts[0], gas: 2300000,
      gasPrice: web3.toWei(20, “shannon”), 
      data: “0x5b620186a05a131560135760016020526000565b600080601f600039601f565b6000f3”}) }
}

I figured that it sends 100 transactions from account 0 with some data. But what is that data and how does it help the DAO from getting drained?

Answer 1

The attack lives from the fact that you can call a function twice with the same balance in your account. Only after the function call is executed your money is detracted. So the spam helps to gain time so that the money is not spend twice. More here: http://vessenes.com/deconstructing-thedao-attack-a-brief-code-tour/

---

The transactions create many empty contracts. By doing so the spammer gets comptition. The empty contract creations. For what do they compete? For the Block Gas Limit:

Blocks, too, have a field called gas limit. It defines the maximum amount of gas all transactions in the whole block combined are allowed to consume. Similar to the maximum block size in Bitcoin (measured in bytes), its purpose is to keep block propagation and processing time low, thereby allowing for a sufficiently decentralized network.

So the attack can not execute the reentrant call because the block gas limit is reached by the contract creations, which has the advantage to be an expensive opcode.