An off-chain signed authorization (allow-mint, gasless action) carries no expiry timestamp. A leaked or old signature stays valid forever, so a single exposure permanently grants the action.
// signature over (user, MINT) with no expiry leaks from a log. // anyone replays it months later to mint for 'user' -> still valid.
require(block.timestamp <= expiry, "expired"); bytes32 digest = _hash(user, action, expiry, nonces[user]++);
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0229 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.