The logic/implementation contract behind a proxy never calls _disableInitializers in its constructor, so the implementation itself can be initialized directly and, via selfdestruct or delegatecall tricks, used to brick or hijack the proxy.
contract Logic is UUPSUpgradeable {
constructor() { _disableInitializers(); }
function initialize() external initializer { __UUPS_init(); }
}
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0009 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.