A privileged mapping (blacklist/frozen) gates transfers, letting an admin freeze any holder's funds at will. Legitimate for some compliance tokens, but an undisclosed or ungoverned freeze switch is a rug/censorship risk that must be surfaced to users.
// admin calls setBlacklist(victim, true) // victim.transfer(...) now reverts forever -> funds are stuck, // while admin retains full mobility.
// if a freeze switch is required, put it behind a timelock + events, // document it, and scope it as narrowly as possible. require(!frozen[from], "frozen");
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0134 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.