Unchecked Low-Level Call Return Value

SAFE-0026 External Calls Checked automatically by the scanner

What goes wrong

The boolean returned by .call/.send/.delegatecall is ignored. A failed transfer or call is treated as success, so accounting proceeds as if value moved when it did not.

How to fix it

the pattern that is safe

(bool ok, ) = msg.sender.call{value: amount}("");
require(ok, "transfer failed");
balances[msg.sender] = 0;

◆

SWC-104. Always check call success.

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$80M · 2022 Fei Protocol / Rari Capital Fuse Reentrancy · 2022 $69.3M · 2023 Curve Finance · Vyper compiler Compiler / toolchain + Reentrancy · 2023 ~$60M · 2016 The DAO Reentrancy · 2016

Related vulnerabilities in External Calls

SAFE-0028Delegatecall to Untrusted / Arbitrary Target critical · External Calls SAFE-0029Arbitrary External Call Injection critical · External Calls SAFE-0027Unchecked ERC-20 transfer/transferFrom Return high · External Calls SAFE-0131Unchecked Low-Level Call Return Value high · External Calls SAFE-0310Return Value of send() Ignored high · External Calls SAFE-0092Return Data Length Not Checked (Memory Bomb / Decode Error) medium · External Calls SAFE-0125Return-Data Bomb / Gas Griefing on External Call medium · External Calls SAFE-0143transfer()/send() 2300-Gas Stipend medium · External Calls

← PreviousInsufficient TWAP Window / Manipulable TWAP Next →Unchecked ERC-20 transfer/transferFrom Return

Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0026 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs