Any function whose outcome depends on being executed first (e.g. claiming a fixed-price opportunity, or a naive auction) is vulnerable to front-running: someone watching the mempool copies or outbids your transaction with higher gas to land first.
# Vulnerable: price depends on execution order
@external
def buy(min_amount: uint256):
# if pool price can move between submission and execution,
# an attacker can sandwich this trade
...Mitigations include slippage/minimum-output parameters (as above), commit-reveal schemes for sensitive actions, and using private mempools/relays for especially sensitive transactions.