Skip to content

Inline Assembly return/revert Bypasses Solidity

SAFE-0303 Low-Level / Assembly Checked automatically by the scanner
1

What goes wrong

Inline assembly uses return()/revert() to exit a function directly. This skips Solidity's normal epilogue (return-value packing, modifier post-code), so post-conditions and cleanup after the call site never execute.

2

The vulnerable pattern

proof of concept — how it is exploited
// function f() external nonReentrant { assembly { return(0,0) } }
// the nonReentrant modifier's lock-release epilogue is skipped -> the
// guard can stay locked, bricking future calls.
3

How to fix it

the pattern that is safe
// prefer Solidity return/revert; only use asm return/revert with full
// awareness that trailing modifier/cleanup code is skipped.
asm return/revert bypasses compiler-inserted code.
4

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0303 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs