A claim/redeem function pays out without marking the claim consumed or updating balances before the transfer, so it can be called repeatedly (often combined with reentrancy) to drain.
function claim() external nonReentrant {
uint a = owed[msg.sender]; owed[msg.sender] = 0; // clear first
token.safeTransfer(msg.sender, a);
}
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0068 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.