Logic Bugs

Solidity Attack Vector #10: Unchecked Call Return Values

SecurityInfinity Research•5 min read

Low-level functions like call, send, and delegatecall return a boolean value indicating success. They do not automatically revert on failure.

If you ignore the return value, your contract will continue execution even if the call failed.

`solidity

(bool success, ) = recipient.call{value: 1 ether}("");

// If success is false, the ETH wasn't sent, but the code proceeds!

Always check the return value:

`solidity

require(success, "Call failed");