Using assert for input validation (consuming all gas pre-0.8 / signaling a bug), or empty require/catch blocks that swallow failures, leads to poor failure modes and hidden errors.
require(msg.value > 0, "no value"); // assert reserved for true invariants
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0097 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.