external-call-safety

Detect unsafe external contract calls and non-standard token behaviors in smart contracts.

Updated Feb 25, 2026
One-click install
npx skills add https://github.com/dajneem23/codex-skills --skill external-call-safety-dajneem23
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: external-call-safety
Source: https://github.com/dajneem23/codex-skills/tree/main/external-call-safety
Command: npx skills add https://github.com/dajneem23/codex-skills --skill external-call-safety-dajneem23

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill identifies and mitigates risks associated with how smart contracts interact with external contracts and tokens, preventing vulnerabilities like fund loss, state desynchronization, and denial-of-service attacks.

Core Features & Use Cases

  • Unchecked External Calls: Detects and flags instances where the success of low-level calls (call, delegatecall, staticcall) is not verified, potentially leading to silent failures.
  • Token Integration Vulnerabilities: Analyzes common pitfalls when integrating with ERC20 tokens, including fee-on-transfer, rebasing tokens, missing return values, and unsafe approval patterns.
  • Use Case: When auditing a DeFi protocol that allows users to deposit arbitrary ERC20 tokens, this Skill can identify if the contract correctly handles tokens with hidden fees or unexpected behaviors, preventing the protocol from becoming insolvent.

Quick Start

Analyze the provided smart contract code for unsafe external call patterns and token integration vulnerabilities.

Frequently Asked Questions about external-call-safety

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect unchecked external calls and unsafe low-level calls in smart contracts?

Unchecked external calls are detected by analyzing low-level calls like `call`, `delegatecall`, and `staticcall` to ensure their success is verified, preventing silent failures and state desynchronization. This analysis flags missing return value checks.

How do I audit smart contracts for fee-on-transfer and rebasing token vulnerabilities?

Auditing for fee-on-transfer and rebasing token vulnerabilities involves analyzing ERC20 integrations using balance-before-after checks and SafeERC20 patterns to handle unexpected token behaviors, preventing protocol insolvency.

What are the risks of integrating ERC-777 tokens and how can I analyze callback vulnerabilities?

ERC-777 tokens introduce reentrancy risks through callback hooks during token transfers. Analyzing these callback vulnerabilities involves checking external interaction patterns to prevent malicious re-entry and denial-of-service attacks.

Does this analysis cover unsafe approve race conditions and blacklist or pausable token issues?

Yes, this analysis covers unsafe approve race conditions and blacklist or pausable token issues by identifying non-standard token behaviors and external contract risks that can restrict transfers or lead to fund loss.

How do I prevent return data bombs and gas stipend limitations in external contract interactions?

Preventing return data bombs and gas stipend limitations requires analyzing external contract interactions for safe ETH transfer patterns and evaluating gas usage to mitigate denial-of-service vectors.