Messages are processed in whatever order they arrive, but application logic assumes sequential delivery (e.g. state updates that must apply in order). A reordered or dropped message leaves state inconsistent or lets an attacker skip a step.
// msg1 = 'set price', msg2 = 'buy at price'. If msg2 lands first, // it executes against stale/zero price -> mispriced fill.
require(nonce == expectedNonce[srcChain], "out of order"); expectedNonce[srcChain]++;
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0248 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.