Polygon places the blame for this bug on not checking that the `from` address in a transfer actually has the balance to cover the transfer in the first-place.While I don't doubt that as a core issue it feels like that may only be part of the issue, the other part being a lack of error checking, or perhaps improper error handling...
12 CVEs, a few fundamental design issues, and some implementation issues.The implementation issues generally just removed some restrictions on abusing the design flaws making them more practical...