The Standard

Summary

The ERC20.transfer() and ERC20.transferFrom() functions return a boolean value indicating success. This parameter needs to be checked for success.

Some tokens do not revert if the transfer fails but return false instead.

Vulnerability Details

The unsafe ERC20 transfers are used in LiquidationPoolManager.sol, forwardRemainingRewards:

and in LiquidationPool, in claimRewards:

Impact

This could lead to silent failure and wrongly updated internal balances. Potentially resulting in stuck user funds.

Tools Used

Manual review

Recommendations

Recommend using OpenZeppelin's SafeERC20 versions with the safeTransfer and safeTransferFrom functions that handle the return value check as well as non-standard-compliant tokens.