Skip to content
high External Calls SWC-104 CWE-252

Unchecked ERC-20 transfer/transferFrom Return

SAFE-0027 External Calls Checked automatically by the scanner
1

What goes wrong

Some ERC-20s (USDT, BNB legacy) return no boolean or return false instead of reverting. Calling transfer/transferFrom without SafeERC20 lets a non-reverting failed transfer pass, breaking accounting.

2

How to fix it

the pattern that is safe
using SafeERC20 for IERC20;
token.safeTransferFrom(msg.sender, address(this), amt);
◆
Use OpenZeppelin SafeERC20 everywhere.
3

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$80M · 2022 Fei Protocol / Rari Capital Fuse Reentrancy · 2022 $69.3M · 2023 Curve Finance · Vyper compiler Compiler / toolchain + Reentrancy · 2023 ~$60M · 2016 The DAO Reentrancy · 2016
4

Related vulnerabilities in External Calls

SAFE-0028Delegatecall to Untrusted / Arbitrary Target critical · External Calls SAFE-0029Arbitrary External Call Injection critical · External Calls SAFE-0026Unchecked Low-Level Call Return Value high · External Calls SAFE-0131Unchecked Low-Level Call Return Value high · External Calls SAFE-0310Return Value of send() Ignored high · External Calls SAFE-0092Return Data Length Not Checked (Memory Bomb / Decode Error) medium · External Calls SAFE-0125Return-Data Bomb / Gas Griefing on External Call medium · External Calls SAFE-0143transfer()/send() 2300-Gas Stipend medium · External Calls
← PreviousUnchecked Low-Level Call Return Value
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0027 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs