2.md

Account Existence Check for low level calls

Description:

As written in the solidity documentation, the low-level functions call, delegatecall and staticcall return true as their first return value if the account called is non-existent, as part of the design of the EVM. Account existence must be checked prior to calling if needed.

Remediation:

Check before any low-level call that the address actually exists, for example before the low level call in the callERC20 function you can check that the address is a contract by checking its code size.

References:

https://blog.solidityscan.com/secure-account-existence-check-for-low-level-calls-468269bdd899