Access decisions rely on raw msg.data, function selectors, or loosely-parsed calldata that an attacker can craft to impersonate a privileged path or replay another method's intent.
function adminThing() external onlyOwner { _doAdminThing(); }
// explicit, typed, access-controlled entrypoint
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0013 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.