Summary

liquidate() has no check on address collateral, address user and uint256 debtToCover.

Vulnerability Details

The liquidate() function has 3 user inputs address collateral, address user and uint256 debtToCover but no safety check apart from moreThanZero modifier.
address collateral could be a wrong token address making the function fail.
address user could be address(0) making the function fail.
uint256 debtToCover could be an uint256 > user's balance.

Impact

Lack of checks can lead to user's errors and protocol malfunction.

Tools Used

Manual review

Recommendations

Add appropriate safety checks.