Solidity

Fallback Function

A fallback function is a Solidity function that runs when calldata does not match any function selector or when Ether is sent without a matching receive function.

Fallback is the contract's last-resort entry point when the call does not match a normal function.

Fallback Function Explained in Detail

The fallback function runs when no other function matches the calldata. It can also receive Ether if the contract has no receive() function and the fallback is payable.

Fallback functions are common in proxies, routers, and contracts that intentionally handle unknown selectors.

Smart contract example

A proxy may route every unknown selector to an implementation:

fallback() external payable {
    address impl = implementation;
    assembly {
        calldatacopy(0, 0, calldatasize())
        let result := delegatecall(gas(), impl, 0, calldatasize(), 0, 0)
        returndatacopy(0, 0, returndatasize())
        switch result
        case 0 { revert(0, returndatasize()) }
        default { return(0, returndatasize()) }
    }
}

That pattern depends on safe selector routing and safe delegatecall behavior.

Fallback Function in Auditing

Fallback functions are hidden entry points. They can route arbitrary calldata, receive Ether unexpectedly, bypass normal function-level checks, or expose proxy logic through function selectors.

Red flags in code

  • Fallback performs privileged routing or state changes.

  • Fallback target can be changed by weak authority.

  • Payable fallback accepts Ether without accounting.

  • Manual calldata parsing in assembly.

  • Authorization depends on msg.sig without checking target context.

How to test or review it

  • Send unknown selectors and verify the behavior is intended.

  • Use the function selector tool to inspect routed calls.

  • Check whether fallback can receive Ether and how it affects accounting.

  • Review fallback separately from named external functions.

  • For proxies, verify admin selectors, implementation address control, and storage layout.

Receive Function

A receive function is a Solidity function that runs when a contract receives plain Ether with empty calldata.

Function Selector

A function selector is the first 4 bytes of calldata that tells an EVM contract which function should handle a call.

Delegatecall

Delegatecall executes code from another contract while reading and writing the caller's storage, preserving the original caller context.

Delegatecall & Call Injection Attacks

Delegatecall and call injection attacks in Solidity: storage collision exploits, proxy vulnerabilities like Parity, and secure upgrade patterns.

Access Control Attacks

Access control attacks in Solidity: broken authorization patterns, privilege escalation paths, and secure role and ownership design.

Function Selector Calculator

Use this SCH tool to turn the concept into practical audit work.

Smart Contract Audit Checklist

Use this SCH tool to turn the concept into practical audit work.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like Fallback Function into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources