F-2023-0005·missing-validation

No account existence check on low-level call

TL;DR

executeMetaTransaction uses a low-level call without checking that the destination address actually has code, so calls to non-existent accounts silently return success.

Severity
MEDIUM
Impact
MEDIUM
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
MEDIUM
Exploitability
MEDIUM
02Section · Description

Description

Low-level calls call/delegatecall/staticcall return true even if the account called is non-existent (per EVM design). Account existence must be checked prior to calling.

03Section · Impact

Impact

The function executeMetaTransaction uses call (which returns boolean), however there is no account existence check for the destination address to.

If it doesn't exist, for some reason, call will still return true (not throw an exception) and successfully pass the return value check on the next line.

Considering the fact that this function is external and can be executed by anyone, there is risk of exploit or misuse.

For reference, see this related high-risk severity finding from Trail of Bit's audit of Hermez Network.

04Section · Recommendation

Recommendation

Check for account-existence before the call() to make this safely extendable to user-controlled address contexts in future.

F-2023-0005

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx