Flawed checkpoint/delegation logic lets the same tokens vote twice (e.g. transfer-then-vote, or delegate and self-vote), inflating effective voting power.
require(!hasVoted[id][msg.sender], "voted"); hasVoted[id][msg.sender]=true; tally += token.getPastVotes(msg.sender, snapshot);
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0062 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.