AWS CloudFormation Linter

If a `return` is incorrectly used in assembly modeSLITHER-W1023 If a `return` is used instead of a `leave`SLITHER-W1026 Storage abiencoderv2 arraySLITHER-W1001 transferFrom uses arbitrary `from`SLITHER-W1002 Incorrect exponentiationSLITHER-W1022 Modifying storage array by valueSLITHER-W1003 ABI encodePacked CollisionSLITHER-W1004 The order of parameters in a shift instruction is incorrectSLITHER-W1005 Multiple constructor schemesSLITHER-W1006 Contract's name reusedSLITHER-W1007 Detected unprotected variablesSLITHER-W1008 Public mappings with nested variablesSLITHER-W1009 Right-To-Left-Override control character is usedSLITHER-W1010 State variables shadowingSLITHER-W1011 Functions allowing anyone to destruct the contractSLITHER-W1012 Uninitialized state variablesSLITHER-W1013 Uninitialized storage variablesSLITHER-W1014 Unprotected upgradeable contractSLITHER-W1015 Use Codex to find vulnerabilitiesSLITHER-W1016 transferFrom uses arbitrary from with permitSLITHER-W1017 Functions that send Ether to arbitrary destinationsSLITHER-W1018 Tainted array length assignmentSLITHER-W1019 Controlled delegatecall destinationSLITHER-W1020 Payable functions using `delegatecall` inside a loopSLITHER-W1021 msg.value inside a loopSLITHER-W1024 Reentrancy vulnerabilities (theft of ethers)SLITHER-W1025 Signed storage integer array compiler bugSLITHER-W1027 Unchecked tokens transferSLITHER-W1028 Weak PRNGSLITHER-W1029 Incorrect ERC721 interfacesSLITHER-W1033 Detects ERC20 tokens that have a function whose signature collides with EIP-2612's DOMAIN_SEPARATOR()SLITHER-W1030 Detect dangerous enum conversionSLITHER-W1031 Incorrect ERC20 interfacesSLITHER-W1032 Dangerous strict equalitiesSLITHER-W1034 Contracts that lock etherSLITHER-W1035 Deletion on mapping containing a structureSLITHER-W1036 State variables shadowing from abstract contractsSLITHER-W1037 Comparing a variable to itself always returns true or false, depending on comparisonSLITHER-W1038 Tautology or contradictionSLITHER-W1039 Unused writeSLITHER-W1040 Misuse of Boolean constantSLITHER-W1041 Constant functions using assembly codeSLITHER-W1042 Constant functions changing the stateSLITHER-W1043 Imprecise arithmetic operations orderSLITHER-W1044 Reentrancy vulnerabilities (no theft of ethers)SLITHER-W1045 Reused base constructorSLITHER-W1046 Dangerous usage of `tx.origin`SLITHER-W1047 Unchecked low-level callsSLITHER-W1048 Unchecked sendSLITHER-W1049 Uninitialized local variablesSLITHER-W1050 Unused return valuesSLITHER-W1051 Detects `for` loops that use `length` member of some storage array in their loop condition and don't modify itSLITHER-W1088 State variables that could be declared constantSLITHER-W1089 Public function that could be declared externalSLITHER-W1090 State variables that could be declared immutableSLITHER-W1091 Contract reads its own variable using `this`SLITHER-W1092 Out-of-order retryable transactionsSLITHER-W1093 Assembly usageSLITHER-W1067 Local variables used prior their declarationSLITHER-W1056 Dangerous usage of `block.timestamp`SLITHER-W1066 Assert state changeSLITHER-W1068 Conformity to Solidity naming conventionsSLITHER-W1077 Unused state variablesSLITHER-W1082 Missing inheritanceSLITHER-W1076 Modifiers that can return the default valueSLITHER-W1052 Functions that are not usedSLITHER-W1084 Built-in symbol shadowingSLITHER-W1053 Local variables shadowingSLITHER-W1054 Uninitialized function pointer calls in constructorsSLITHER-W1055 Constructor called not implementedSLITHER-W1057 Multiple calls in a loopSLITHER-W1058 Missing Events Access ControlSLITHER-W1059 Missing Events ArithmeticSLITHER-W1060 Dangerous unary expressionsSLITHER-W1061 Missing Zero Address ValidationSLITHER-W1062 Benign reentrancy vulnerabilitiesSLITHER-W1063 Reentrancy vulnerabilities leading to out-of-order EventsSLITHER-W1064 A low level callee may consume all callers gas unexpectedlySLITHER-W1065 Comparison to boolean constantSLITHER-W1069 Detects functions with high (> 11) cyclomatic complexitySLITHER-W1070 Deprecated Solidity StandardsSLITHER-W1071 Un-indexed ERC20 event parametersSLITHER-W1072 Function initializing state variablesSLITHER-W1073 Detects using-for statement usage when no function from a given library matches a given typeSLITHER-W1074 Low level callsSLITHER-W1075 If different pragma directives are usedSLITHER-W1078 Redundant statementsSLITHER-W1079 Incorrect Solidity versionSLITHER-W1080 Unimplemented functionsSLITHER-W1081 Costly operations in a loopSLITHER-W1083 Reentrancy vulnerabilities through send and transferSLITHER-W1085 Variable names are too similarSLITHER-W1086 Conformance to numeric notation best practicesSLITHER-W1087

SLITHER-W1048

Unchecked low-level callsSLITHER-W1048

Major

Anti-pattern

The return value of a low-level call is not checked.

Exploit Scenario

contract MyConc{
    function my_func(address payable dst) public payable{
        dst.call.value(msg.value)("");
    }
}

The return value of the low-level call is not checked, so if the call fails, the Ether will be locked in the contract. If the low level is used to prevent blocking operations, consider logging failed calls.

Recommendation

Ensure that the return value of a low-level call is checked or logged.

Learn more

unchecked-lowlevel on Slither's wiki.