Reentrancy Attacks

Reentrancy is the most infamous smart contract vulnerability. It occurs when a contract makes an external call before updating its state. The called contract can 're-enter' the original function, exploiting the stale state. The 2016 DAO hack exploited reentrancy, leading to a $60M loss and Ethereum's hard fork. Prevention: follow the Checks-Effects-Interactions pattern (update state before external calls), use OpenZeppelin's ReentrancyGuard, or use transfer() which forwards only 2,300 gas (insufficient for reentrancy).