ecrecover returns address(0) for a malformed signature. If the recovered signer is used for authorization without a require(signer != address(0)) check, an attacker submits garbage bytes and, where the expected signer field is uninitialised (also 0), passes the check.
// mapping(address => bool) authorized; // default false, but... // if code checks `if (ecrecover(...) == owner)` and owner slot is 0 in a // fresh/clone proxy, a bogus signature recovers to 0 == owner -> bypass.
address signer = ecrecover(digest, v, r, s);
require(signer != address(0) && signer == expected, "bad sig");
// prefer ECDSA.recover (OpenZeppelin), which reverts on 0 and high-s
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0112 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.