Pools that read live balances for liquidity share math can be skewed by directly transferring tokens to the pool ('donation'), changing reserves outside of mint/burn and distorting LP value.
uint256 r0 = reserve0; // stored, updated only on mint/burn/swap (Uniswap-style)
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.