A signed message (permit, claim, meta-tx) is verified without consuming a per-signer nonce. The same signature can be replayed to repeat the privileged action — claim an airdrop many times, or re-execute a withdrawal.
// signature over (user, 100) has no nonce. // attacker resubmits the identical (user,100,sig) N times. // claim() pays 100 each time until the contract is drained.
bytes32 digest = _hash(user, amount, nonces[user]++); // consume nonce
require(_recover(digest, sig) == user, "bad sig");
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0113 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.