A critical dependency (router, token, treasury) is hardcoded as a literal address, or key parameters are unexplained magic numbers. Hardcoded addresses break on other chains/forks and can point to a wrong or attacker contract if mistyped.
// address constant ROUTER = 0x7a25...; // mainnet Uniswap // deployed to an L2 where that address is empty/an attacker contract // -> swaps call into the wrong code.
// inject addresses via constructor/initializer and validate them
constructor(address _router) { require(_router != address(0)); router = _router; }
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0259 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.