Internal balance tracking diverges from real token holdings due to missed updates on edge paths (fees, donations, partial fills), letting some users over-withdraw at others' expense.
// Credit exactly what is received/owed; centralize accounting in one internal fn
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0071 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.