Skip to content

Title

Unchecked Call Return Value

Relationships

CWE-252: Unchecked Return Value

Description

The return value of a message call is not checked. Execution will resume even if the called contract throws an exception. If the call fails accidentally or an attacker forces the call to fail, this may cause unexpected behaviour in the subsequent program logic.

Remediation

If you choose to use low-level call methods, make sure to handle the possibility that the call will fail by checking the return value.

References

Samples

unchecked_return_value.sol

pragma solidity 0.4.25;

contract ReturnValue {

  function callchecked(address callee) public {
    require(callee.call());
  }

  function callnotchecked(address callee) public {
    callee.call();
  }
}