A user-supplied bytes parameter is abi.decoded into a typed structure without validation. Malformed input reverts (griefing) or, when decoded into addresses/amounts used for accounting or calls, lets an attacker steer privileged logic.
// function exec(bytes calldata data) external { // (address to, uint256 amt) = abi.decode(data,(address,uint256)); // token.transfer(to, amt); } // attacker crafts data to move tokens to themselves.
require(data.length >= EXPECTED, "bad payload"); (address to, uint256 amt) = abi.decode(data, (address, uint256)); require(to != address(0) && amt > 0, "bad params");
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0308 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.