Funds or logic are committed to a CREATE2 address before the contract is deployed; a chain reorg or salt reuse can deploy different code at that address, or an attacker can pre-compute and grief.
// Deploy first, verify code, then interact; bind salt to immutable init code hash.
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0094 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.