What Role Does the CALL Opcode Play in Enabling Reentrancy?

The CALL opcode in the Ethereum Virtual Machine (EVM) is used to execute a message call to an external contract. When a contract sends Ether to another address, it uses a form of the CALL opcode.

Crucially, this opcode temporarily transfers control flow to the recipient contract. If the recipient is a malicious contract, it can use this moment of control to call back into the original contract's vulnerable withdrawal function, initiating the Reentrancy attack before the state is updated.