The contract rolls its own boolean reentrancy lock instead of a battle-tested guard. Hand-rolled locks frequently mis-order set/clear, forget to reset on a revert path, or leave gaps, re-opening the reentrancy they were meant to close.
// bool locked; function f() external { require(!locked); locked=true; ... // external.call(...); locked=false; } // if the external call reverts on a path that skips locked=false, the // contract is bricked; if any function forgets the check, reentrancy is open.
// use OpenZeppelin ReentrancyGuard (nonReentrant) instead of a manual bool
import "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0307 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.