A transparent proxy exposes admin functions whose 4-byte selectors can collide with implementation functions. A crafted call can be routed to the wrong target, invoking admin logic from a user path (or vice-versa).
// proxy has admin fn with selector 0x4f1ef286; implementation has a // public fn colliding on the same selector. Depending on caller, // the call hits the unintended function.
// use OpenZeppelin TransparentUpgradeableProxy (admin routed separately), // or UUPS where upgrade logic lives in the implementation.
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0231 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.