A signed or hashed cross-chain payload omits the destination chainId. A message intended for one chain can be replayed on another chain served by the same contract/validator set.
// message hash = keccak256(nonce, to, amount) // no chainId // same signed message is accepted on chain A and chain B -> double release.
bytes32 id = keccak256(abi.encode(block.chainid, nonce, to, amount));
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0247 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.