# Ignored callback outcome marked success

Callback or handler result discarded, error swallowed, or status derived from call success instead of actual outcome

_Area: Smart contract access control and control flow. Seen in 14 disclosed reports; latest 2025-04-10. Updated 2026-10-22._

## How it works
A caller invokes a handler, hook, or callback and then decides success from the wrong signal: the call returning without reverting, a boolean that only means "did not throw," or a status field it never reads. The real outcome (destination-chain status, handler error, emitted events) is dropped. The system records success, advances state, or releases value on a failure that was never observed.

## Where it shows up
- A handler's return value (Result, status enum, error) is assigned to `_` or ignored.
- Status is set from a boolean return rather than a passed-in outcome field [E6](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-05.md).
- Error flags combined with bitwise OR and dispatched on exact values, so combinations fall through as success [E4](https://bugbountylibrary.com/r/c4%3A2022-05-opensea-seaport%3AH-02.md).
- A loop that returns early on per-item error but still advances its checkpoint cursor [E2](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-04.md).
- A shared "committed"/"succeeded" flag reused across proposals or subsystems [E1](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-17.md).
- try-catch that treats empty revert data as out-of-gas [E7](https://bugbountylibrary.com/r/c4%3A2024-07-reserve%3AM-04.md).
- Direct handler calls that bypass the framework's event plumbing [E5](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-03.md).

## How to review
For every external call whose result matters, confirm the outcome actually read is the one that reflects the real result, not merely that the call returned. Check: does the status assignment consume the destination/handler outcome field [E6](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-05.md)? Does an error path either revert or explicitly refund before state advances [E8](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-07.md)? Does a checkpoint advance only after all items in the range are processed [E2](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-04.md)? Does settlement validate the specific proposal matches the buyout that succeeded, not just that some buyout did [E1](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-17.md)? Does the returned Result's events reach the parent context [E5](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-03.md)?

## Variants seen
- Status derived from handler boolean, ignoring cross-chain status [E6](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-05.md).
- Shared committed flag lets a failed proposal settle [E1](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-17.md).
- Observer cursor advances past unprocessed events [E2](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-04.md).
- Consensus handler error swallowed, app layer unaware [E3](https://bugbountylibrary.com/r/c4%3A2022-11-canto%3AH-02.md).
- Bitwise-OR error flags produce unhandled success state [E4](https://bugbountylibrary.com/r/c4%3A2022-05-opensea-seaport%3AH-02.md).
- Hook Result discarded, events lost [E5](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-03.md).
- Empty revert misread as OOG [E7](https://bugbountylibrary.com/r/c4%3A2024-07-reserve%3AM-04.md).
- Abort path with no refund [E8](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-07.md).

## Impact and severity
High: stolen vault assets [E1](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-17.md), censorship of all later events [E2](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-04.md), permanently locked funds [E5](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-03.md)[E8](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-07.md), failed cross-chain messages marked SUCCESS [E6](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-05.md), near-zero-price fulfillment [E4](https://bugbountylibrary.com/r/c4%3A2022-05-opensea-seaport%3AH-02.md). Severity rises when the ignored outcome gates asset custody or a shared cursor/flag.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-17.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-04.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-11-canto%3AH-02.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-05-opensea-seaport%3AH-02.md
- E5: https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-03.md
- E6: https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-05.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-07-reserve%3AM-04.md
- E8: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-07.md