"What will be the basis of the legal action?"
Manipulating a system to gain possession of property you aren't entitled to. Courts deal with this all the time, and they're not going to take "The code had a bug so it's all cool" as a defense. Even if you see this as ridiculously bad security, it's still illegal to walk into a building whose door is standing open and take things, and while the owner probably won't be getting sympathy or an insurance payout, the taker can still go to prison for it. Some early cryptocurrency people might have enjoyed saying "the code is law", but the real law doesn't tend to think so.
Biting the hand that feeds IT
