Socket’s route trusted the caller to encode the swap, and one of them encoded a transferFrom instead.

A reward calculation subtracted two balance readings and paid out the attacker’s own deposit as a reward.

A sell tax charged to the liquidity pool instead of the seller, and the reserve invariant it rewrote.

An attacker supplied the target and payload of a call Arcadia’s Rebalancer made, and pointed a trusted contract’s authority at other users’ accounts.

An insolvency vulnerability drained $197M from Euler Finance: one function added in a later upgrade skipped the solvency check every other function ran.

How Beanstalk’s emergencyCommit allowed borrowed capital to satisfy a governance supermajority threshold and drain $182M in one transaction.