External Call: Definition, Smart Contract Example & Audit Notes

External Calls Explained in Detail

An external call is any interaction where a contract calls another address. This includes interface calls, token transfers, Ether transfers, call, delegatecall, staticcall, and calls made through hooks or callbacks.

Smart contract example

The withdrawal function below sends Ether before clearing the user's balance:

function withdraw() external {
    uint256 amount = balances[msg.sender];

    (bool ok,) = msg.sender.call{value: amount}("");
    require(ok);

    balances[msg.sender] = 0;
}

The receiver can reenter before the balance is cleared.

External Calls in Auditing

External calls give another address control. That address can revert, consume gas, return false, reenter, trigger hooks, or change state in a dependency.

Red flags in code

State updates happen after an external call.
Low-level call return value is ignored.
External call target or calldata is user-controlled.
Calls are made inside unbounded loops.
Token transfers assume standard ERC-20 behavior.
Hooks such as ERC-777, ERC-721, or ERC-1155 callbacks are not considered.
Contract relies on external state after making a call.

How to test or review it

List every external call and mark whether the target is trusted, untrusted, or user-controlled.
Check ordering with checks-effects-interactions.
Test with malicious receiver contracts that reenter, revert, return false, consume gas, and call dependent contracts.
Verify return values from low-level calls and non-standard tokens are handled correctly.
Review delegatecall separately because it changes the caller's storage.

Reentrancy

Reentrancy is a smart contract vulnerability where external code calls back into a contract before the first call finishes, often before balances, ownership, or other state has been updated.

Delegatecall

Delegatecall executes code from another contract while reading and writing the caller's storage, preserving the original caller context.

Checks-Effects-Interactions

Checks-Effects-Interactions is a Solidity pattern that validates inputs first, updates contract state second, and performs external calls last to reduce reentrancy risk.

Reentrancy

Reentrancy in Solidity explained with real exploit flow, vulnerable patterns, and practical defenses like checks-effects-interactions and reentrancy guards.