Logic assumes an address is 'safe' because its extcodehash matches a known value or is non-zero. Code can differ at call time (proxies, metamorphic contracts) or an EOA can become a contract later, breaking the assumption.
// require(a.codehash == KNOWN); // a is a proxy // the proxy's implementation is upgraded post-check -> behaviour changes // while codehash (of the proxy) stays the same.
// don't equate 'known codehash' with 'trusted forever'; re-validate intent, // or restrict to an explicit allowlist you control.
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0239 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.