A defect in what a protocol was designed to do, rather than in how it was coded — the implementation is correct, the rule it implements is not.
Why it matters
This class survives audits most often, because nothing looks wrong line by line. The error is in an assumption: that a value cannot be donated, that a position cannot be made unprofitable to liquidate, that two operations cannot be combined. Automated tooling does not flag a rule it was never told to doubt.
What you can check
Post-mortems for this class read differently from memory-safety ones: they describe a sequence of individually legitimate operations. Audit scopes that mention economic or invariant testing are addressing this category; a scope limited to code review largely is not.
Where it showed up
Records in the Incident Tracker that turn on this: Euler Finance donation attack.
Not advice. Definitions are for understanding, not instruction. Nothing here is financial, legal, tax or security advice.