Unchecked external calls

What it is

The OWASP entry widens SWC-104 to include trusting the behaviour of contracts you do not control: tokens with transfer fees, tokens that return no value, rebasing balances, and callbacks that run code you have not read.

Why it matters

Accounting drifts from reality. A fee-on-transfer token credited at the requested amount rather than the received amount leaves the contract permanently short.

How to fix it

• Check every return value; use SafeERC20 for tokens.
• Measure balances before and after a transfer rather than trusting the amount parameter.
• Treat every external contract as adversarial, including well-known ones.

How it is detected

Every audit on EVM Smart Audit checks for SC06 and reports it as passed or flagged in the standards coverage grid — so the report tells you it was checked even when nothing was found. See the detector suite for what else runs alongside it, or the full database for the other 21 checks.