The signed digest omits an EIP-712 domain separator with block.chainid and the verifying contract address. A signature valid on one chain (or on a fork) is replayable on another chain where the same contract is deployed.
// same contract on Ethereum + Polygon, digest has no chainid. // user signs a withdrawal on mainnet; attacker replays the exact bytes // on Polygon and withdraws there too.
bytes32 DOMAIN = keccak256(abi.encode(
keccak256("EIP712Domain(...,uint256 chainId,address verifyingContract)"),
..., block.chainid, address(this)));
bytes32 digest = keccak256(abi.encodePacked("\x19\x01", DOMAIN, structHash));
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0114 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.