What Specific Code Vulnerability in the DAO Contract Allowed the Reentrancy?

The vulnerability was in the DAO's splitDAO function, which was used to withdraw funds. The code first checked the user's balance, then performed an external call to send the user their Ether ( msg.sender.call.value() ), and only after that did it update the internal ledger to reflect the withdrawal.

This violated the Checks-Effects-Interactions pattern. By making the external call before updating the state, it opened the door for the attacker to recursively call the function and withdraw the same funds repeatedly before the balance was set to zero.