Slimmed Down Version of the Hegic Options contract so that you can try to spot the bug, ref: https://twitter.com/HegicOptions/status/1253954145113038849

Hegic.sol

pragma solidity ^0.6.6;

contract HegicReproduceBug {
  Option[] public options;
  enum State { Active, Exercised, Expired }
  
  struct Option {
    State state;
    uint expiration;
  }
  
  // depending on ETH or ERC20, there's a different `create` function
  // and its matching `exercise` (omitted here since it's not important)
  function create() public returns (uint optionID) {
      optionID = options.length;
      options.push(Option ({
          state: State.Active,
          expiration: now // for simplicity let's assume it instantly expires
      }));
  }
  
  function unlock(uint[] memory optionIDs) public {
      // why would you write this function in such confusing way, 
      // to save 1 line of code?
      for(uint i; i < options.length; unlock(optionIDs[i++])){}
  }

  function unlock(uint optionID) internal {
      Option storage option = options[optionID];
      require(option.expiration < now, "Option has not expired yet");
      require(option.state == State.Active, "Option is not active");

      option.state = State.Expired;
      // unlock the option (give money back to users)
  }
}