A function lets the caller specify an arbitrary target and calldata, which the contract then executes. Attackers point it at tokens/approvals the contract holds, draining them or calling privileged callbacks.
mapping(address=>bool) public allowedTarget;
function call(address t, bytes calldata d) external onlyOwner {
require(allowedTarget[t], "target");
(bool ok,) = t.call(d); require(ok);
}
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0029 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.