EVM

Low-Level Call

A low-level call is a Solidity call such as call, delegatecall, staticcall, or send that returns success and data instead of using typed function checks.

A low-level call gives more control, but it also removes many safety rails.

Low-Level Call Explained in Detail

Low-level calls interact with addresses without normal Solidity interface checks. They usually return (bool success, bytes memory data) and leave error handling to the caller.

They are powerful, but easy to misuse.

Smart contract example

(bool ok, bytes memory data) = target.call(payload);
require(ok, "call failed");

Ignoring ok creates the same failure mode covered in unchecked return value attacks: the contract continues after a failed call.

Low-Level Call in Auditing

Low-level calls often appear in proxies, routers, plugins, callbacks, ETH transfers, and generic execution systems. They can introduce reentrancy, unchecked failures, arbitrary target execution, and confusing return data.

Auditors check the target, payload, success handling, and state-update order.

Red flags in code

  • success is ignored.

  • Target or calldata is user-controlled without restrictions.

  • ETH is sent before state updates.

  • Return data length and type are not checked.

  • delegatecall is used where call was intended.

How to test or review it

  • Test target success, revert, false return, and malformed return data.

  • Use malicious receivers to test reentrancy.

  • Review call ordering against checks-effects-interactions.

  • Confirm allowed targets and selectors are constrained.

  • Decode and validate return data where it affects state.

External Call

An external call is an interaction where one smart contract calls another address, creating a trust boundary and possible control-flow risk.

Unchecked Return Value

An unchecked return value bug happens when code ignores whether a low-level call or token operation succeeded.

Delegatecall

Delegatecall executes code from another contract while reading and writing the caller's storage, preserving the original caller context.

Unchecked Return Value Attacks

SWC-104 unchecked call return values let Solidity calls fail silently. Learn the bug pattern, real exploit cases, and SafeERC20 fixes.

Smart Contract Audit Checklist

Use this SCH tool to turn the concept into practical audit work.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like Low-Level Call into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources