unchecked-calls

# Unchecked external calls detection ## When this applies - Low-level `call`, `delegatecall`, `staticcall`, `send` - ERC-20 `transfer` / `transferFrom` / `approve` (non-SafeERC20) - Calls to user-provided addresses - Multi-call patterns that don't propagate failures - Try-catch swallowing all errors ## Detection patterns ### Ignored `.call` return (HIGH) ```solidity (bool ok,) = target.call(data); // ← ok unused // or worse: target.call(data); // ← Solidity ≥0.5 still allows this with warning ``` Always `require(ok, "call failed");` unless an intentional best-effort. ### ERC-20 without SafeERC20 (HIGH) USDT and other non-conformant tokens don't return `bool`. Naive call: ```solidity IERC20(usdt).transfer(to, amt); // ← reverts on USDT due to ABI mismatch ``` Use OZ `SafeERC20`'s `safeTransfer` which handles missing return values. ### Return-data check missing (HIGH) Even compliant ERC20 returning `false` instead of reverting is silently passed: ```solidity bool ok = token.transfer(to, amt); // ← ok unused, returns false on failure ``` ### `try`/`catch` swallows everything (MEDIUM-HIGH) ```solidity try external.call() { /* … */ } catch { /* silently ignored */ } ``` Without inspecting `catch (bytes memory reason)`, you lose all info; transitioning a critical revert into a silent success is a bug. ### Address with no code (HIGH on `call`) ```solidity (bool ok,) = target.call(data); require(ok); ``` `ok = true` even if `target` is an EOA with no con...