and this will be the 500k trap:

  function() public payable {
      deposit();
  }

If it didn't have this no-arg behavior, then the mistake wouldn't have been made.