A contract trusts a cross-domain message sender (e.g. L1->L2 messenger) but checks the wrong field, so messages from arbitrary senders are accepted as if from the trusted counterpart.
function onMessage() external {
require(msg.sender == address(messenger), "not messenger");
require(messenger.xDomainMessageSender() == l1Counterpart, "bad origin");
_act();
}
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0064 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.