Mishandling of ETH in Smart contracts
If your contract relies on address(this).balance for checks, you’re taking a risk
Any contract can force-send ETH to yours via selfdestruct, bypassing:
receive/fallback
require checks
Access controls
This can break invariants or cause DoS