We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
[Question] Attack Vector described in Vipercoin's `approve` annotation
In [L89 of `vipercoin.v.py`](https://github.com/ethereum/viper/blob/master/examples/tokens/vipercoin.v.py#L89), the `approve` method has an annotation that begins like this

>To prevent attack vectors like the one described here and discussed here,

I don't see any description of the attack vectors described, perhaps there should be an external link here?  Point me in the right direction and I can make the PR for it. :)

Thanks!

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `examples/tokens/vipercoin.v.py`
Content:
```
1 # Viper Port of MyToken
2 # THIS CONTRACT HAS NOT BEEN AUDITED!
3 # ERC20 details at:
4 # https://theethereum.wiki/w/index.php/ERC20_Token_Standard
5 # https://github.com/ethereum/EIPs/blob/master/EIPS/eip-20-token-standard.md
6 # Events of the token.
7 Transfer: __log__({_from: indexed(address), _to: indexed(address), _value: num256})
8 Approval: __log__({_owner: indexed(address), _spender: indexed(address), _value: num256})
9 
10 
11 # Variables of the token.
12 name: bytes32
13 symbol: bytes32
14 totalSupply: num
15 decimals: num
16 balances: num[address]
17 allowed: num[address][address]
18 
19 @public
20 def __init__(_name: bytes32, _symbol: bytes32, _decimals: num, _initialSupply: num):
21     
22     self.name = _name
23     self.symbol = _symbol
24     self.decimals = _decimals
25     self.totalSupply = _initialSupply * 10 ** _decimals
26     self.balances[msg.sender] = self.totalSupply
27 
28 @public
29 @constant
30 def symbol() -> bytes32:
31 
32     return self.symbol
33 
34 @public
35 @constant
36 def name() -> bytes32:
37 
38     return self.name
39 
40 
41 # What is the balance of a particular account?
42 @public
43 @constant
44 def balanceOf(_owner: address) -> num256:
45 
46     return as_num256(self.balances[_owner])
47 
48 
49 # Return total supply of token.
50 @public
51 @constant
52 def totalSupply() -> num256:
53 
54     return as_num256(self.totalSupply)
55 
56 
57 # Send `_value` tokens to `_to` from your account
58 @public
59 def transfer(_to: address, _amount: num(num256)) -> bool:
60 
61     assert self.balances[msg.sender] >= _amount
62     assert self.balances[_to] + _amount >= self.balances[_to]
63 
64     self.balances[msg.sender] -= _amount  # Subtract from the sender
65     self.balances[_to] += _amount  # Add the same to the recipient
66     log.Transfer(msg.sender, _to, as_num256(_amount))  # log transfer event.
67 
68     return True
69 
70 
71 # Transfer allowed tokens from a specific account to another.
72 @public
73 def transferFrom(_from: address, _to: address, _value: num(num256)) -> bool:
74 
75     assert _value <= self.allowed[_from][msg.sender]
76     assert _value <= self.balances[_from]
77 
78     self.balances[_from] -= _value  # decrease balance of from address.
79     self.allowed[_from][msg.sender] -= _value  # decrease allowance.
80     self.balances[_to] += _value  # incease balance of to address.
81     log.Transfer(_from, _to, as_num256(_value))  # log transfer event.
82     
83     return True
84 
85 
86 # Allow _spender to withdraw from your account, multiple times, up to the _value amount.
87 # If this function is called again it overwrites the current allowance with _value.
88 #
89 # NOTE: To prevent attack vectors like the one described here and discussed here,
90 #       clients SHOULD make sure to create user interfaces in such a way that they
91 #       set the allowance first to 0 before setting it to another value for the
92 #       same spender. THOUGH The contract itself shouldn't enforce it, to allow
93 #       backwards compatilibilty with contracts deployed before.
94 #
95 @public
96 def approve(_spender: address, _amount: num(num256)) -> bool:
97 
98     self.allowed[msg.sender][_spender] = _amount
99     log.Approval(msg.sender, _spender, as_num256(_amount))
100 
101     return True
102 
103 
104 # Get the allowance an address has to spend anothers' token.
105 @public
106 def allowance(_owner: address, _spender: address) -> num256:
107 
108     return as_num256(self.allowed[_owner][_spender])
109
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/examples/tokens/vipercoin.v.py b/examples/tokens/vipercoin.v.py
--- a/examples/tokens/vipercoin.v.py
+++ b/examples/tokens/vipercoin.v.py
@@ -86,12 +86,15 @@
 # Allow _spender to withdraw from your account, multiple times, up to the _value amount.
 # If this function is called again it overwrites the current allowance with _value.
 #
-# NOTE: To prevent attack vectors like the one described here and discussed here,
-#       clients SHOULD make sure to create user interfaces in such a way that they
+# NOTE: We would like to prevent attack vectors like the one described here:
+#       https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/edit#heading=h.m9fhqynw2xvt
+#       and discussed here:
+#       https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729
+#
+#       Clients SHOULD make sure to create user interfaces in such a way that they
 #       set the allowance first to 0 before setting it to another value for the
 #       same spender. THOUGH The contract itself shouldn't enforce it, to allow
 #       backwards compatilibilty with contracts deployed before.
-#
 @public
 def approve(_spender: address, _amount: num(num256)) -> bool:
 
@@ -101,7 +104,7 @@
     return True
 
 
-# Get the allowance an address has to spend anothers' token.
+# Get the allowance an address has to spend another's token.
 @public
 def allowance(_owner: address, _spender: address) -> num256:

{"golden_diff": "diff --git a/examples/tokens/vipercoin.v.py b/examples/tokens/vipercoin.v.py\n--- a/examples/tokens/vipercoin.v.py\n+++ b/examples/tokens/vipercoin.v.py\n@@ -86,12 +86,15 @@\n # Allow _spender to withdraw from your account, multiple times, up to the _value amount.\n # If this function is called again it overwrites the current allowance with _value.\n #\n-# NOTE: To prevent attack vectors like the one described here and discussed here,\n-#       clients SHOULD make sure to create user interfaces in such a way that they\n+# NOTE: We would like to prevent attack vectors like the one described here:\n+#       https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/edit#heading=h.m9fhqynw2xvt\n+#       and discussed here:\n+#       https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729\n+#\n+#       Clients SHOULD make sure to create user interfaces in such a way that they\n #       set the allowance first to 0 before setting it to another value for the\n #       same spender. THOUGH The contract itself shouldn't enforce it, to allow\n #       backwards compatilibilty with contracts deployed before.\n-#\n @public\n def approve(_spender: address, _amount: num(num256)) -> bool:\n \n@@ -101,7 +104,7 @@\n     return True\n \n \n-# Get the allowance an address has to spend anothers' token.\n+# Get the allowance an address has to spend another's token.\n @public\n def allowance(_owner: address, _spender: address) -> num256:\n", "issue": "[Question] Attack Vector described in Vipercoin's `approve` annotation\nIn [L89 of `vipercoin.v.py`](https://github.com/ethereum/viper/blob/master/examples/tokens/vipercoin.v.py#L89), the `approve` method has an annotation that begins like this\r\n\r\n>To prevent attack vectors like the one described here and discussed here,\r\n\r\nI don't see any description of the attack vectors described, perhaps there should be an external link here?  Point me in the right direction and I can make the PR for it. :)\r\n\r\nThanks!\n", "before_files": [{"content": "# Viper Port of MyToken\n# THIS CONTRACT HAS NOT BEEN AUDITED!\n# ERC20 details at:\n# https://theethereum.wiki/w/index.php/ERC20_Token_Standard\n# https://github.com/ethereum/EIPs/blob/master/EIPS/eip-20-token-standard.md\n# Events of the token.\nTransfer: __log__({_from: indexed(address), _to: indexed(address), _value: num256})\nApproval: __log__({_owner: indexed(address), _spender: indexed(address), _value: num256})\n\n\n# Variables of the token.\nname: bytes32\nsymbol: bytes32\ntotalSupply: num\ndecimals: num\nbalances: num[address]\nallowed: num[address][address]\n\n@public\ndef __init__(_name: bytes32, _symbol: bytes32, _decimals: num, _initialSupply: num):\n    \n    self.name = _name\n    self.symbol = _symbol\n    self.decimals = _decimals\n    self.totalSupply = _initialSupply * 10 ** _decimals\n    self.balances[msg.sender] = self.totalSupply\n\n@public\n@constant\ndef symbol() -> bytes32:\n\n    return self.symbol\n\n@public\n@constant\ndef name() -> bytes32:\n\n    return self.name\n\n\n# What is the balance of a particular account?\n@public\n@constant\ndef balanceOf(_owner: address) -> num256:\n\n    return as_num256(self.balances[_owner])\n\n\n# Return total supply of token.\n@public\n@constant\ndef totalSupply() -> num256:\n\n    return as_num256(self.totalSupply)\n\n\n# Send `_value` tokens to `_to` from your account\n@public\ndef transfer(_to: address, _amount: num(num256)) -> bool:\n\n    assert self.balances[msg.sender] >= _amount\n    assert self.balances[_to] + _amount >= self.balances[_to]\n\n    self.balances[msg.sender] -= _amount  # Subtract from the sender\n    self.balances[_to] += _amount  # Add the same to the recipient\n    log.Transfer(msg.sender, _to, as_num256(_amount))  # log transfer event.\n\n    return True\n\n\n# Transfer allowed tokens from a specific account to another.\n@public\ndef transferFrom(_from: address, _to: address, _value: num(num256)) -> bool:\n\n    assert _value <= self.allowed[_from][msg.sender]\n    assert _value <= self.balances[_from]\n\n    self.balances[_from] -= _value  # decrease balance of from address.\n    self.allowed[_from][msg.sender] -= _value  # decrease allowance.\n    self.balances[_to] += _value  # incease balance of to address.\n    log.Transfer(_from, _to, as_num256(_value))  # log transfer event.\n    \n    return True\n\n\n# Allow _spender to withdraw from your account, multiple times, up to the _value amount.\n# If this function is called again it overwrites the current allowance with _value.\n#\n# NOTE: To prevent attack vectors like the one described here and discussed here,\n#       clients SHOULD make sure to create user interfaces in such a way that they\n#       set the allowance first to 0 before setting it to another value for the\n#       same spender. THOUGH The contract itself shouldn't enforce it, to allow\n#       backwards compatilibilty with contracts deployed before.\n#\n@public\ndef approve(_spender: address, _amount: num(num256)) -> bool:\n\n    self.allowed[msg.sender][_spender] = _amount\n    log.Approval(msg.sender, _spender, as_num256(_amount))\n\n    return True\n\n\n# Get the allowance an address has to spend anothers' token.\n@public\ndef allowance(_owner: address, _spender: address) -> num256:\n\n    return as_num256(self.allowed[_owner][_spender])\n", "path": "examples/tokens/vipercoin.v.py"}], "after_files": [{"content": "# Viper Port of MyToken\n# THIS CONTRACT HAS NOT BEEN AUDITED!\n# ERC20 details at:\n# https://theethereum.wiki/w/index.php/ERC20_Token_Standard\n# https://github.com/ethereum/EIPs/blob/master/EIPS/eip-20-token-standard.md\n# Events of the token.\nTransfer: __log__({_from: indexed(address), _to: indexed(address), _value: num256})\nApproval: __log__({_owner: indexed(address), _spender: indexed(address), _value: num256})\n\n\n# Variables of the token.\nname: bytes32\nsymbol: bytes32\ntotalSupply: num\ndecimals: num\nbalances: num[address]\nallowed: num[address][address]\n\n@public\ndef __init__(_name: bytes32, _symbol: bytes32, _decimals: num, _initialSupply: num):\n    \n    self.name = _name\n    self.symbol = _symbol\n    self.decimals = _decimals\n    self.totalSupply = _initialSupply * 10 ** _decimals\n    self.balances[msg.sender] = self.totalSupply\n\n@public\n@constant\ndef symbol() -> bytes32:\n\n    return self.symbol\n\n@public\n@constant\ndef name() -> bytes32:\n\n    return self.name\n\n\n# What is the balance of a particular account?\n@public\n@constant\ndef balanceOf(_owner: address) -> num256:\n\n    return as_num256(self.balances[_owner])\n\n\n# Return total supply of token.\n@public\n@constant\ndef totalSupply() -> num256:\n\n    return as_num256(self.totalSupply)\n\n\n# Send `_value` tokens to `_to` from your account\n@public\ndef transfer(_to: address, _amount: num(num256)) -> bool:\n\n    assert self.balances[msg.sender] >= _amount\n    assert self.balances[_to] + _amount >= self.balances[_to]\n\n    self.balances[msg.sender] -= _amount  # Subtract from the sender\n    self.balances[_to] += _amount  # Add the same to the recipient\n    log.Transfer(msg.sender, _to, as_num256(_amount))  # log transfer event.\n\n    return True\n\n\n# Transfer allowed tokens from a specific account to another.\n@public\ndef transferFrom(_from: address, _to: address, _value: num(num256)) -> bool:\n\n    assert _value <= self.allowed[_from][msg.sender]\n    assert _value <= self.balances[_from]\n\n    self.balances[_from] -= _value  # decrease balance of from address.\n    self.allowed[_from][msg.sender] -= _value  # decrease allowance.\n    self.balances[_to] += _value  # incease balance of to address.\n    log.Transfer(_from, _to, as_num256(_value))  # log transfer event.\n    \n    return True\n\n\n# Allow _spender to withdraw from your account, multiple times, up to the _value amount.\n# If this function is called again it overwrites the current allowance with _value.\n#\n# NOTE: We would like to prevent attack vectors like the one described here:\n#       https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/edit#heading=h.m9fhqynw2xvt\n#       and discussed here:\n#       https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729\n#\n#       Clients SHOULD make sure to create user interfaces in such a way that they\n#       set the allowance first to 0 before setting it to another value for the\n#       same spender. THOUGH The contract itself shouldn't enforce it, to allow\n#       backwards compatilibilty with contracts deployed before.\n@public\ndef approve(_spender: address, _amount: num(num256)) -> bool:\n\n    self.allowed[msg.sender][_spender] = _amount\n    log.Approval(msg.sender, _spender, as_num256(_amount))\n\n    return True\n\n\n# Get the allowance an address has to spend another's token.\n@public\ndef allowance(_owner: address, _spender: address) -> num256:\n\n    return as_num256(self.allowed[_owner][_spender])\n", "path": "examples/tokens/vipercoin.v.py"}]}