Two lines of code in two orders. Send the money first and record it after, and the recipient has time to call withdraw again, and again. Record first, and the second call finds an empty account.
Everything is computed in your browser; nothing is sent anywhere.
From the book
Nobody Owns Money · Chapter 23
A Robbery by the Rules
Next to this experiment in the chapter
Soon an open letter appeared online from someone who called himself the attacker. Its authenticity was never confirmed, but everyone remembered the argument. The author wrote that he had studied the code carefully, had used an opportunity the code provided, and considered the ether he got a legitimate reward, and that his lawyers had confirmed he had broken nothing. If code is law, then he had not broken the law. Any attempt to take the ether back he called theft.