An initializer function (used instead of a constructor in upgradeable/proxy contracts) is callable by anyone and lacks the initializer guard. An attacker front-runs deployment or re-initializes to set themselves as owner.
function initialize(address _owner) external initializer {
__Ownable_init();
transferOwnership(_owner);
}
constructor() { _disableInitializers(); }
Incidents this entry cites by name:
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0008 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.