A reentrancy vulnerability in uniclyNFT's PointFarm contract allowed an attacker to repeatedly call the deposit() function without proper state updates. The attacker minted rewards multiple times before the contract could update rewardDebt, draining uJENNY tokens through reentrancy into external calls.