A reentrancy vulnerability in the Smoofs staking contract allowed attackers to drain funds through unsafe external calls that enabled state to be manipulated during transaction execution.