Somewhere between the first smart contract audit and the hundredth, the attack surface moved. Nobody noticed, except the ...