Here’s a brief list of the most common reasons for smart contract hacks:
standard vulnerabilities like reentrancy, denial of service, or overflows;
incorrect access control and roles systems;
incorrect math and rewards calculations, inappropriate token amounts handling, accuracy mistakes;
incorrect token transfer logic;
loopholes in the business logic;
architectural mistakes that lead to deadlocks or contract misuse.