CVE's for "smart" contracts, legal execution engines

https://medium.com/@Swarm/daos-hacks-and-the-law-eb6a33808e3e#.sfd7r5gfq

https://blog.blockstack.org/simple-contracts-are-better-contracts-what-we-can-learn-from-the-dao-6293214bad3a#.t6xpbyacr

The media is generally using terms like "attack" and "hack", so let's assume for a moment this is an attack (and not a legal but crafty method to obey the letter of the law as it were, but bypass the spirit) and that Ethereum/smart contracts are classed as a software rather then a service (again, I can see arguments going both ways). My thought is much like a protocol vulnerability (e.g. CVE-2009-3555) we need to think about and be ready to assign CVE's for these types of issues, at a minimum I think we can all agree that a smart contract execution engine that has some "Classic" type of flaw like a buffer overflow would deserve a CVE, but within the context of a legal contract execution engine I would think that it can be argued the execution of the legal argument is similar to code in that you can have language that exploits certain weaknesses or ill defined cases resulting in behavior that is obviously unwanted and not what the creators of the system had in mind when they created it (like some random person taking $50 million in funds). 

So the main issues that need to be dealt with:

1) Where do we draw the line on software/service for blockchain technologies? 

2) Where do we draw the line for legal/contract execution security vulnerabilities? Can it to be in something that "ships" like a standard legal contract for rental of a property for example?

3) Where do we draw the line on "letter of the law" vs. "spirit of the law", e.g. in computers memory corruption/manipulation violates what the code creator probably wanted, but was allowed by the code. I would like to avoid the need for court cases to decide these issues before a CVE can be assigned =). 

Do we have any lawyers familiar with legal contract execution engines? I suspect there aren't many of those.