Don't trust outside contract

[ryu9827]

multisender/contracts/contracts/multisender/UpgradebleStormSender.sol

Lines 102 to 117 in 17153e9

	function multisendToken(address token, address[] _contributors, uint256[] _balances) public hasFee payable {
	if (token == 0x000000000000000000000000000000000000bEEF){
	multisendEther(_contributors, _balances);
	} else {
	uint256 total = 0;
	require(_contributors.length <= arrayLimit());
	ERC20 erc20token = ERC20(token);
	uint8 i = 0;
	for (i; i < _contributors.length; i++) {
	erc20token.transferFrom(msg.sender, _contributors[i], _balances[i]);
	total += _balances[i];
	}
	setTxCount(msg.sender, txCount(msg.sender).add(1));
	Multisended(total, token);
	}
	}

When our contract is calling functions in outside contracts, we need to verify if the expected behaviors are really being executed.
At line 111, it's calling erc20token.transferFrom(). We expect the token contract to transfer the tokens to the _contributors by this function. But a dummy token contract can be designed not to do the transaction.
This is usually a critical issue due to the potential loss if the Dapp syncronizes the balances of those _contributors. But in our case, it is simply a minor issue.