A state variable or array length is read from storage on every loop iteration (SLOAD is expensive). Beyond gas cost, re-reading a length that a re-entrant call can change is also a subtle correctness risk.
// for (uint i; i < items.length; ++i) total += balances[items[i]]; // items.length + each balances[...] SLOAD every iteration -> costly, // and a callback that grows items mid-loop changes the bound.
uint256 len = items.length; // cache in memory
for (uint256 i; i < len; ++i) { ... }
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0260 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.