Smart contract vulnerability where an external call re‑enters the calling contract before state updates finalize, enabling double‑spend style exploits without proper guards.