Unchecked External Call Flagger

WHAT IT DOES

This tool connects to your EVM wallet and scans smart contract source code to identify unchecked external calls. It detects low-level calls including .call(), .delegatecall(), .staticcall(), and send/transfer operations that do not validate return values or handle failures properly. The tool analyzes the context of each call to determine whether it is guarded by require, assert, if statements, or try/catch blocks, flagging unchecked calls for further review.

HOW TO USE

Connect your Web3 wallet using the Connect button. Paste your contract source code in the Contract Source Code field. Click "Flag Unchecked Calls" to analyze the source code. Click "Load Sample Contract" to populate fields with an example contract containing both checked and unchecked call patterns. Results appear in the Results card with a summary of total calls found, number of unchecked calls, and risk level (Low, Medium, High), followed by a detailed breakdown of each detected call with its context and status.

TECHNICAL MECHANISM: CONTEXT-AWARE CALL PATTERN ANALYSIS

The tool uses regular expression pattern matching to detect external call patterns in contract source code. It identifies .call(), .delegatecall(), .staticcall(), .send(), and .transfer() invocations. For each detected call, the tool extracts the surrounding code context (up to 200 characters before and after the call) and checks for the presence of validation mechanisms: require() statements, assert() statements, if condition checks, and try/catch blocks. Calls with validation are marked as "Checked," while calls without validation are flagged as "Unchecked." Each finding is categorized by severity (Critical for .delegatecall(), High for .call() and call with value, Medium for .send() and .transfer()).

WHAT IT CANNOT SEE

This tool cannot determine whether an unchecked call actually leads to a vulnerability without runtime context—unchecked calls may be safe in certain contexts. It cannot detect calls that are handled through try/catch or require statements that are not syntactically obvious—the tool's pattern matching may miss non-standard patterns. It cannot analyze contracts with obfuscated or highly optimized code—the tool works best with readable source code. It relies on source code parsing and may miss calls in libraries or inherited contracts—the tool only scans the provided source. It cannot guarantee that flagged calls are unsafe or that safe calls are not flagged—the tool provides warnings, not definitive conclusions.

PLEASE NOTE

This is a read-only tool—it never signs transactions. All data is processed in-memory and never persists. The tool supports EVM chains only—Ethereum, Polygon, BSC, Arbitrum, Optimism, Avalanche, Base, and Fantom. The tool performs static analysis and should be used as a starting point for security review, not as a final audit. Always conduct thorough testing and consult security professionals.