A vulnerability class in which a contract calls out to another contract before updating its own state, allowing the external contract to call back in and act on stale state.
Why it matters
One of the oldest and best-understood smart contract vulnerabilities, defended against with reentrancy guards. The Curve incident is notable because the guards were correctly written in source but emitted incorrectly by particular compiler versions.
What you can check
The pattern is a contract that sends value before it finishes updating its own accounting, letting the receiving code call back in while the books are still stale. Audit reports and post-mortems usually name it directly, and the fix is normally described as reordering state updates ahead of external calls.
Where it showed up
Records in the Incident Tracker that turn on this: The DAO recursive call exploit and Curve Finance Vyper reentrancy.
Not advice. Definitions are for understanding, not instruction. Nothing here is financial, legal, tax or security advice.