Assembly copies returndata (returndatacopy) or abi.decode is applied to a call's raw output without validating that the callee returned enough data. A short or crafted return can decode into attacker-favorable values.
// (bool ok, bytes memory r) = t.call(data); uint v = abi.decode(r,(uint)); // malicious t returns empty -> abi.decode reads zero/garbage, // e.g. a 'balance' of 0 that skips a require.
(bool ok, bytes memory ret) = t.call(data); require(ok && ret.length >= 32, "bad return"); uint256 v = abi.decode(ret, (uint256));
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0237 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.