The boolean success flag from a .call / .send is discarded. A failed transfer or external call is treated as success, so the contract updates state (marks a payment made, a withdrawal complete) even though the value never moved.
// to.call{value: amt}(""); // return value ignored // paid[user] = true; // marked paid even on failure // recipient's receive() reverts -> no ETH sent, but state says 'paid'.
(bool ok, ) = payable(to).call{value: amount}("");
require(ok, "transfer failed");
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0131 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.