Why Must State Updates Occur before External Calls?

State updates must occur before external calls to prevent a reentrancy attack. If an external call is made before the contract's state variables (like a user's balance) are updated, the external contract can recursively call back into the original function.

The original function will then execute again, seeing the old, un-updated state, allowing the attacker to withdraw funds repeatedly. By updating the state first, the re-entrant call will see the correct, updated balance and fail the check, protecting the funds.