A deposit/withdraw/borrow changes balances without first accruing pending interest or rewards to the current index. The new balance retroactively earns (or dodges) interest for a period it wasn't present, mispricing every position.
// user deposits right before a big accrual without _updateIndex() // -> their fresh balance is credited interest for the whole past period, // stealing yield from existing depositors.
modifier accrue() { _updateIndex(); _; }
function deposit(uint256 a) external accrue { ... } // accrue first
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0220 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.