What Would Be the Vulnerable Code Structure That Violates the CEI Pattern?

A vulnerable code structure violates CEI by performing the external interaction before the state change. For example, a withdrawal function that first sends the Ether ( msg.sender.call{value: amount}("") ) and then updates the user's balance ( balance = 0 ) is vulnerable.

The attacker's fallback function is executed during the external call, allowing them to re-enter and withdraw again before the balance is zeroed.