address.send() returns a boolean that is discarded. send() does not revert on failure, so a failed transfer is treated as success and the contract advances its state (marks paid / burns the claim) while no ETH actually moved.
// to.send(amount); // returns false on failure, ignored // paid[user] = true; // state says paid, but nothing was sent // recipient's receive() reverts -> user loses the payout permanently.
(bool ok, ) = payable(to).call{value: amount}("");
require(ok, "transfer failed"); // or check send()'s return and revert
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0310 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.