Description

Currently liquidate(...) does not revert the transaction if the following ERC20 transfer fails:

if (param.totalDebt > discountedFloorPriceInTotal) {
    param.remaningDebt = param.totalDebt - discountedFloorPriceInTotal;
} else {
    uint256 refundAmount = discountedFloorPriceInTotal -
        param.totalDebt;
    IERC20(param.currency).transfer(param.vault, refundAmount);
    param.receivedAmount -= refundAmount;
}

Impact

The call should never fail as the funds will always be in the account.

Recommendations

Add a check and revert on a false return value from the ERC20 transfer call.

Remediation

Commit 654a9242↗ was indicated as containing the remediation. The commit correctly fixes the issue by using safeTransfer instead of transfer, which does revert if the transfer fails.