A deposit function calls permit() then transferFrom(). An attacker front-runs with the same permit (public in the mempool), consuming the nonce, so the victim's own deposit reverts on the now-invalid permit — a griefing DoS.
// victim tx: permit(sig); transferFrom(...) // attacker copies sig, submits permit(sig) first -> nonce consumed // victim's permit(sig) reverts 'invalid signature' -> deposit fails.
// wrap permit in try/catch so a consumed permit doesn't brick the deposit
try token.permit(...) {} catch {}
token.transferFrom(msg.sender, address(this), amount);
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0207 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.