Reentrancy and checks-effects-interactions
A reentrancy attack happens when a contract makes an external call, like sending ETH to another address, before finishing its own bookkeeping. If the recipient is itself a contract, its fallback code can call right back into the original function while it's still mid-execution, and because the balance hasn't been updated yet, it can withdraw again, and again, before the first call ever finishes. This is exactly what happened in the 2016 DAO hack, and it remains one of the most infamous smart contract exploits in Ethereum's history.
The fix is the checks-effects-interactions pattern: first check conditions like `require(balance >= amount)`, then update your own state, effects, and only after that make any external call, interactions. In the vulnerable snippet from this course's overview, the balance is decremented after the external call, leaving a window for reentry. The fixed version decrements the balance first, so by the time the attacker's contract re-enters, the balance already reflects the withdrawal and the require check simply fails.