EVM

staticcall

staticcall is a low-level EVM call that allows reading data from another contract but reverts if the callee attempts to modify state.

staticcall is a read-only external call, but the data it returns can still be wrong or manipulated.

staticcall Explained in Detail

staticcall is a low-level call that forbids state changes in the callee. It is often used for interface probing, oracle reads, and generic view calls.

Read-only does not mean trustworthy. The called contract can still return manipulated, malformed, or stale data.

Smart contract example

(bool ok, bytes memory data) = oracle.staticcall(payload);

The caller still needs to check ok and decode data safely.

staticcall in Auditing

Protocols often use staticcall to read prices, balances, permissions, or configuration. If the return value is trusted blindly, attackers may exploit bad data or failed calls.

Auditors review read paths that influence state-changing decisions.

Red flags in code

  • Failed staticcall is treated as a valid zero value.

  • Return data length is not checked.

  • Calls target user-controlled contracts.

  • Oracle data is read after manipulable state changes.

  • Gas-heavy view functions can grief callers.

How to test or review it

  • Test success, revert, short return data, and malformed return data.

  • Manipulate oracle or pool state before the read.

  • Check whether read-only reentrancy can expose inconsistent values.

  • Constrain trusted targets.

  • Decode return values only after validating success and length.

Low-Level Call

A low-level call is a Solidity call such as call, delegatecall, staticcall, or send that returns success and data instead of using typed function checks.

Read-Only Reentrancy

Read-only reentrancy happens when a view function returns stale or inconsistent state during an unfinished state transition, and another contract relies on that value.

Oracle Manipulation

Oracle manipulation occurs when an attacker distorts a data source that a smart contract trusts, causing the contract to make decisions from unsafe data.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like staticcall into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources