unchecked-return-values

Name: unchecked-return-values
Availability: InStock
Author: Apeguru

Detect unchecked return values from low-level calls in Solidity contracts.

1|1|Updated Feb 18, 2026

Search Tags:#security #vulnerability #auditing #smart contracts #solidity #unchecked calls

Ready to run

npx skills add https://github.com/Apegurus/solidity-argus --skill unchecked-return-values

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: unchecked-return-values
Source: https://github.com/Apegurus/solidity-argus/tree/main/skills/vulnerability-patterns/unchecked-return-values
Command: npx skills add https://github.com/Apegurus/solidity-argus --skill unchecked-return-values

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill identifies and helps mitigate a critical security vulnerability in Solidity smart contracts where the return values of low-level calls (.call(), .send(), .delegatecall()) are not properly checked, potentially leading to unexpected state changes and exploits.

Core Features & Use Cases

Vulnerability Detection: Automatically scans Solidity code for instances of .call(), .send(), and .delegatecall() where the success or failure status is ignored.
Severity Classification: Assigns a 'Medium' severity and 'High' confidence to detected vulnerabilities based on specific detection rules.
SWC Mapping: Links detected issues to the relevant Smart Contract Weakness Classification (SWC) identifier (SWC-104).
Use Case: A smart contract developer can use this Skill to proactively audit their code before deployment, ensuring that all critical external interactions are handled safely and robustly.

Quick Start

Audit the provided Solidity contract for unchecked return values in low-level calls.

Frequently Asked Questions about unchecked-return-values

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is an unchecked return value vulnerability in Solidity smart contracts?▼

An unchecked return value vulnerability in Solidity occurs when low-level calls like `.call()`, `.send()`, or `.delegatecall()` execute without verifying their boolean success status, potentially leading to unexpected state changes and contract exploits.

How do I audit Solidity code for unchecked low-level calls?▼

To audit Solidity code for unchecked low-level calls, scan the contract for `.call()`, `.send()`, and `.delegatecall()` invocations and flag instances where the boolean return value indicating success or failure is not explicitly checked.

Why does ignoring the return value of a low-level call cause state inconsistencies?▼

Ignoring the return value of a low-level call causes state inconsistencies because the called function may fail silently without reverting the transaction, allowing subsequent contract logic to execute based on a false assumption of successful state modification.

Does this unchecked call detection map to standard smart contract security guidelines?▼

Unchecked call detection maps directly to SWC-104 guidelines, assigning a 'Medium' severity and 'High' confidence rating to vulnerabilities where `.call()`, `.send()`, or `.delegatecall()` success statuses are ignored.

When do I need to check the return value of `.send()` versus `.transfer()` in Solidity?▼

You need to check the return value of `.send()` when handling external interactions because it returns a boolean on failure instead of reverting, whereas `.transfer()` automatically reverts on failure and does not require explicit return value checks.

What are the limitations of detecting unchecked calls in Solidity smart contracts?▼

The limitation of detecting unchecked calls is that it primarily targets `.call()`, `.send()`, and `.delegatecall()` syntax patterns, meaning complex logic hiding failed state updates through alternative mechanisms may not be flagged under SWC-104 rules.