The Standard

Summary

LiquidationPool.claimRewards will not work with non standard erc20 tokens as it doesn't uses safe erc20 library.

Vulnerability Details

claimRewards function allows user to receive purchased token from liquidation. Those tokens can be any that are allowed for colateral. When function sends those token to the claimes, then it uses usual erc20 transfer, which expects to get bool result.

There are 2 problems here:

• result is not checked to be true

• tokens that don't return bool will revert in this call

Impact

According to 2 problems impact can be:

• incorrect paymnent handling of rewards(when they were not actually paid)

• dos of rewards claiming for a token

Tools Used

VsCode

Recommendations

Use some library like SafeERC20 to execute call.