An EIP-2612 permit signature is accepted without the contract enforcing (or the token supporting) the signed deadline. A permit meant to expire can be executed arbitrarily later, extending an approval the user believed was time-boxed.
// user signs permit(deadline = now + 10 min) but the router never // checks deadline. The signature sits in the mempool and is executed // hours later at a worse moment.
token.permit(owner, spender, value, deadline, v, r, s);
require(block.timestamp <= deadline, "permit expired"); // for custom flows
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0206 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.