Provide an Example of How Two Functions Might Share a State That Could Be Exploited

Consider a contract with a withdraw() function and a transfer() function, both of which rely on a userBalances mapping. The withdraw() function might incautiously make an external call to a third-party service before updating the user's balance.

An attacker could use this external call to re-enter the contract and call the transfer() function. Because the userBalances state is not yet updated, the transfer() function would see the original, pre-withdrawal balance, allowing the attacker to transfer funds they should no longer have access to.