Skip to main content

Unprotected External Calls

What it detects​

Contracts sometimes expose functions that make arbitrary external calls based on parameters supplied by the caller. Without proper restrictions, attackers can make the contract interact with unintended addresses or malicious code.

Typical symptoms​

  • Function forwards arbitrary calldata to another contract
  • No validation on target address or function selector

Solidity snippet (v0.8.25)​

pragma solidity ^0.8.25;

contract Executor {
    function callAny(address target, bytes calldata data) external {
        // No checks on caller or target
        (bool ok, ) = target.call(data);
        require(ok, "fail");
    }
}

Why it matters on EVM​

Unprotected external calls can be used to exploit other contracts, drain funds, or execute reentrancy attacks.