Unchecked call return value

What it is

call, delegatecall and send return a boolean rather than reverting on failure. Ignoring that value means execution continues as though the call succeeded. The same applies to ERC-20 transfers: some tokens return false instead of reverting, and some return nothing at all.

Why it matters

Your contract records a payment that never arrived, or credits a deposit for tokens it never received. The accounting and the actual balances diverge, quietly, until someone notices the gap.

The vulnerable pattern

A failed send is indistinguishable from a successful one.

msg.sender.send(amount);          // returns false, ignored
token.transfer(recipient, amount); // may return false

The fix, in code

Check the result, or use a wrapper that reverts for you.

(bool ok, ) = msg.sender.call{value: amount}("");
require(ok, "transfer failed");

SafeERC20.safeTransfer(token, recipient, amount);

How to fix it

• Capture and require the return value of every low-level call.
• Use SafeERC20 for token transfers so non-standard tokens are handled.
• Remember that a failing transfer inside a loop can block every other recipient — prefer pull payments.

How it is detected

Every audit on EVM Smart Audit checks for SWC-104 and reports it as passed or flagged in the standards coverage grid — so the report tells you it was checked even when nothing was found. See the detector suite for what else runs alongside it, or the full database for the other 21 checks.