Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: The `Goldigovernor` smart contract contains a vulnerability due to an incorrect assumption about the. The `Goldigovernor` smart contract contains a vulnerability due to an incorrect assumption about the block time. Specifically, the contract's voting period and delay limits are set based on a block time of 15 seconds, as indicated by the constants `MIN_VOTING_PERIOD`, `MAX_VOTING_PERIOD`, `MIN_VOTIN...

Vulnerable code:
```\n@notice Minimum voting period\nuint32 public constant MIN_VOTING_PERIOD = 5760; // About 24 hours\n\n@notice Maximum voting period\nuint32 public constant MAX_VOTING_PERIOD = 80640; // About 2 weeks\n\n@notice Minimum voting delay\nuint32 public constant MIN_VOTING_DELAY = 1;\n\n@notice Maximum voting delay\nuint32 public constant MAX_VOTING_DELAY = 40320; // About 1 week\n```\n```\nBerachain has the following properties:\n\n    - Block time: 5s\n```
MEDIUM severity: The vulnerability lies in the way the `contributionToken` is handled in the `contribute` and `_trans. The vulnerability lies in the way the `contributionToken` is handled in the `contribute` and `_transfer` functions. The `contributionToken` is stored as an `ERC20` contract type, which is then directly compared to the constant `ETH` (represented by `address(0x0)`). This comparison is problematic bec...

Vulnerable code:
```\nfunction contribute(address _contributor, uint256 _value) external payable nonReentrant auth(CONTRIBUTE_ROLE) {\n    require(state() == State.Funding, ERROR_INVALID_STATE);\n\n    if (contributionToken == ETH) {\n        require(msg.value == _value, ERROR_INVALID_CONTRIBUTE_VALUE);\n    } else {\n        require(msg.value == 0, ERROR_INVALID_CONTRIBUTE_VALUE);\n    }\n}\n```\n```\nrequire(\n    ERC20(_token).safeTransfer(_to, _amount),\n    ERROR_TOKEN_TRANSFER_REVERTED\n);\n```
MEDIUM severity: The interest component of the underlying amount is permanently locked in the BlueBerryBank contract,. The interest component of the underlying amount is permanently locked in the BlueBerryBank contract, rendering it irretrievable. This occurs when a user attempts to withdraw their underlying amount using the `withdrawLend` function, which caps the withdrawable amount to the initial underlying deposi...

Vulnerable code:
```\nwAmount = wAmount > pos.underlyingAmount\n   ? pos.underlyingAmount\n    : wAmount;\n\npos.underlyingVaultShare -= shareAmount;\npos.underlyingAmount -= wAmount;\nbank.totalLend -= wAmount;\n```
MEDIUM severity: The `IchiVaultSpell` contract's withdrawal mechanism, which involves trading one token for another o. The `IchiVaultSpell` contract's withdrawal mechanism, which involves trading one token for another on Uniswap V3, lacks slippage protection. This vulnerability allows malicious MEV bots to identify and exploit these trades, executing a "sandwich attack" to manipulate the price and steal a significan...

Vulnerable code:
```\nif (amountToSwap > 0) {\n    swapPool = IUniswapV3Pool(vault.pool());\n    swapPool.swap(\n        address(this),\n       !isTokenA,\n        int256(amountToSwap),\n        isTokenA\n           ? UniV3WrappedLibMockup.MAX_SQRT_RATIO - 1\n            : UniV3WrappedLibMockup.MIN_SQRT_RATIO + 1,\n        abi.encode(address(this))\n    );\n}\n```\n```\nfunction uniswapV3SwapCallback(\n    int256 amount0Delta,\n    int256 amount1Delta,\n    bytes calldata data\n) external override {\n    if (msg.sender!= address(swapPool)) {\n        revert NOT_FROM_UNIV3(msg.sender);\n    }\n    address payer = abi.decode(data, (address));\n\n    if (amount0Delta > 0) {\n        if (payer == address(this)) {\n            IERC20Upgradeable(swapPool.token0()).safeTransfer(\n                msg.sender,\n                uint256(amount0Delta)\n            );\n        } else {\n            IERC20Upgradeable(swapPool.token0()).safeTransferFrom(\n                payer,\n                msg.sender,\n                uint256(amount0Delta)\n            );\n        }\n    } else if (amount1Delta > 0) {\n        if (payer == address(this)) {\n            IERC20Upgradeable(swapPool.token1()).safeTransfer(\n                msg.sender,\n                uint256(amount1Delta)\n            );\n        } else {\n            IERC20Upgradeable(swapPool.token1()).safeTransferFrom(\n                payer,\n                msg.sender,\n                uint256(amount1Delta)\n            );\n        }\n    }\n}\n```
MEDIUM severity: The `parseAllPrice` function in the DODOv3 protocol is unable to process tokens with a decimal preci. The `parseAllPrice` function in the DODOv3 protocol is unable to process tokens with a decimal precision greater than 18. This limitation is due to the fact that the function is not designed to accommodate tokens with a higher number of decimal places, such as NEAR, which has 24 decimal places. As a...

Vulnerable code:
```\nif (tokenDecimal!= 18) {\n    uint256 fixDecimal = 18 - tokenDecimal;\n    bidDownPrice = bidDownPrice / (10 ** fixDecimal);\n    bidUpPrice = bidUpPrice / (10 ** fixDecimal);\n    askDownPrice = askDownPrice * (10 ** fixDecimal);\n    askUpPrice = askUpPrice * (10 ** fixDecimal);\n}\n```
MEDIUM severity: The vulnerability in the NyPtvFantomWftmBooSpookyV2StrategyToUsdc.sol contract lies in the way it ha. The vulnerability in the NyPtvFantomWftmBooSpookyV2StrategyToUsdc.sol contract lies in the way it handles slippage during trades of BOO tokens to USDC. The `MAX_SLIPPAGE` constant is used to limit the allowed slippage in these trades, which is calculated as a percentage of the total amount of BOO to...

Vulnerable code:
```\nfunction _swapFarmEmissionTokens() internal {\n    IERC20Upgradeable boo = IERC20Upgradeable(BOO);\n    uint256 booBalance = boo.balanceOf(address(this));\n\n    if (booToUsdcPath.length < 2 || booBalance == 0) {\n        return;\n    }\n\n    boo.safeIncreaseAllowance(SPOOKY_ROUTER, booBalance);\n\n    uint256[] memory amounts = \n    IUniswapV2Router02(SPOOKY_ROUTER).getAmountsOut(booBalance, booToUsdcPath);\n\n    uint256 amountOutMin = (amounts[amounts.length - 1] * MAX_SLIPPAGE) / PERCENT_DIVISOR;\n\n    IUniswapV2Router02(SPOOKY_ROUTER).swapExactTokensForTokensSupportingFeeOnTransferTokens(booBalance, amountOutMin, booToUsdcPath, address(this), block.timestamp);\n}\n```
MEDIUM severity: The `MarginTrading` contract is designed to manage margin trading operations, where users can deposi. The `MarginTrading` contract is designed to manage margin trading operations, where users can deposit funds to secure their positions. However, a critical issue arises when a trade is opened, as the entire balance of the token is deposited into Aave, rather than just the traded funds. This is contra...

Vulnerable code:
```\n_tradeAmounts[i] = IERC20(_tradeAssets[i]).balanceOf(address(this)); \n_lendingPoolDeposit(_tradeAssets[i], _tradeAmounts[i], 1)\n```
MEDIUM severity: The `SwellLib.BOT` contract contains a vulnerability that allows for subtle rug-pulling of withdrawa. The `SwellLib.BOT` contract contains a vulnerability that allows for subtle rug-pulling of withdrawals. When a user initiates a withdrawal request, the `swETH` is burned, and the current exchange rate `rateWhenCreated` is fetched from `swETH::swETHToETHRate`. This rate is then used to calculate the...

Vulnerable code:
```\nuint256 rateWhenCreated = AccessControlManager.swETH().swETHToETHRate();\n```\n```\nfunction processWithdrawals(\n    uint256 _lastTokenIdToProcess,\n    uint256 _processedRate\n) external override {\n    checkRole(SwellLib.BOT);\n}\n```\n```\nuint256 finalRate = (_processedRate > rateWhenCreated)\n   ? rateWhenCreated\n    : _processedRate;\n```\n```\nuint256 requestExitedETH = wrap(amount).mul(wrap(finalRate)).unwrap();\n```
MEDIUM severity: The `StrategyWrapper` contract, a straightforward implementation of the `IStrategy` interface, is ex. The `StrategyWrapper` contract, a straightforward implementation of the `IStrategy` interface, is explicitly designed not to be inherited from. This is explicitly stated in its NatSpec documentation, which highlights the contract's purpose as a simple, basic, and "do-nothing" strategy that holds a s...

Vulnerable code:
```\ncontract StrategyWrapper is IStrategy {\n    /**\n     * @title Extremely simple implementation of `IStrategy` interface.\n     * @author Layr Labs, Inc.\n     * @notice Simple, basic, "do-nothing" Strategy that holds a single underlying token and returns it on withdrawals.\n     * Assumes shares are always 1-to-1 with the underlyingToken.\n     * @dev Unlike `StrategyBase`, this contract is not designed to be inherited from.\n     * @dev This contract is expressly not intended for use with 'fee-on-transfer'-type tokens.\n     * Setting the `underlyingToken` to be a fee-on-transfer token may result in improper accounting.\n     */\n    contract StrategyWrapper is IStrategy {\n```
MEDIUM severity: This vulnerability arises from a design flaw in the proposal cancellation mechanism, which allows th. This vulnerability arises from a design flaw in the proposal cancellation mechanism, which allows the `proposalThreshold` to be modified by the `multisig` entity. This modification can have unintended consequences, particularly when a user has already proposed a proposal and has insufficient voting...

Vulnerable code:
```\nfunction setProposalThreshold(uint256 newProposalThreshold) external {\n    if (msg.sender!= multisig) {\n        revert NotMultisig();\n    }\n    if (newProposalThreshold < MIN_PROPOSAL_THRESHOLD || newProposalThreshold > MAX_PROPOSAL_THRESHOLD) {\n        revert InvalidVotingParameter();\n    }\n    uint256 oldProposalThreshold = proposalThreshold;\n    proposalThreshold = newProposalThreshold;\n    emit ProposalThresholdSet(oldProposalThreshold, proposalThreshold);\n}\n```
MEDIUM severity: The vulnerability arises when agents have the opportunity to either `escape` or `heal` before the `_. The vulnerability arises when agents have the opportunity to either `escape` or `heal` before the `_requestForRandomness` function is called, and the order of execution between these two functions is not specified. This ambiguity can lead to unfair outcomes in the game, particularly when there are o...

Vulnerable code:
```\nfunction heal(uint256[] calldata agentIds) external nonReentrant {\n    _assertFrontrunLockIsOff();\n    if (gameInfo.activeAgents <= NUMBER_OF_SECONDARY_PRIZE_POOL_WINNERS) {\n        revert HealingDisabled();\n    }\n```\n```\nfunction escape(uint256[] calldata agentIds) external nonReentrant {\n    _assertFrontrunLockIsOff();\n\n    uint256 agentIdsCount = agentIds.length;\n    _assertNotEmptyAgentIdsArrayProvided(agentIdsCount);\n\n    uint256 activeAgents = gameInfo.activeAgents;\n    uint256 activeAgentsAfterEscape = activeAgents - agentIdsCount;\n    _assertGameIsNotOverAfterEscape(activeAgentsAfterEscape);\n\n    uint256 currentRoundAgentsAlive = agentsAlive();\n\n    uint256 prizePool = gameInfo.prizePool;\n    uint256 secondaryPrizePool = gameInfo.secondaryPrizePool;\n    uint256 reward;\n    uint256[] memory rewards = new uint256[](agentIdsCount);\n\n    for (uint256 i = 0; i < agentIdsCount; i++) {\n        uint256 agentId = agentIds[i];\n        _assertAgentOwnership(agentId);\n\n        uint256 index = agentIndex(agentId);\n        _assertAgentStatus(agents[index], agentId, AgentStatus.Active);\n\n        uint256 totalEscapeValue = prizePool / currentRoundAgentsAlive;\n        uint256 rewardForPlayer = (totalEscapeValue * _escapeMultiplier(currentRoundAgentsAlive)) / ONE_HUNDRED_PERCENT_IN_BASIS_POINTS;\n        rewards[i] = rewardForPlayer;\n        reward += rewardForPlayer;\n\n        uint256 rewardToSecondaryPrizePool = (totalEscapeValue - rewardForPlayer) * _escapeRewardSplitForSecondaryPrizePool(currentRoundAgentsAlive) / ONE_HUNDRED_PERCENT_IN_BASIS_POINTS;\n\n        unchecked {\n            prizePool -= rewardForPlayer - rewardToSecondaryPrizePool;\n        }\n        secondaryPrizePool += rewardToSecondaryPrizePool;\n\n        _swap({\n            currentAgentIndex: index,\n            lastAgentIndex: currentRoundAgentsAlive,\n            agentId: agentId,\n            newStatus: AgentStatus.Escaped\n        });\n\n        unchecked {\n            currentRoundAgentsAlive--;\n            i++;\n        }\n    }\n\n    // This is equivalent to\n    // unchecked {\n    //     gameInfo.activeAgents = uint16(activeAgentsAfterEscape);\n    //     gameInfo.escapedAgents += uint16(agentIdsCount);\n    // }\n```
MEDIUM severity: The vulnerability lies in the way the system treats the USD1 token. Specifically, it is priced as $1. The vulnerability lies in the way the system treats the USD1 token. Specifically, it is priced as $1 instead of being pegged to USDT, which allows for arbitrage opportunities. This discrepancy in pricing enables users to exploit the system by swapping USD1 for USDT at an inflated rate, effectively c...

Vulnerable code:
```\naddress priceQuoteToken = _getPriceQuoteToken(tokenIn, tokenOut);\nprice = oracle.getLatestPrice(priceQuoteToken);\n_checkPrice(priceQuoteToken, price);\n\nfeeNumerator = isBuy? pair.buyFee : pair.sellFee;\nfeeToken = IERC20Token(priceQuoteToken == tokenIn? tokenOut : tokenIn);\n\nSwapRequest memory request;\nrequest.tokenIn = tokenIn;\nrequest.tokenOut = tokenOut;\nrequest.amountType = amountType;\nrequest.amount = amount;\nrequest.feeNumerator = feeNumerator;\nrequest.feeBase = tokenManager.SWAP_FEE_BASE();\nrequest.feeToken = address(feeToken);\nrequest.price = price;\nrequest.priceBase = 10 ** oracle.decimals();\nrequest.quoteToken = priceQuoteToken;\n\n(amountIn, amountOut, fee) = _calculateSwapResult(request);\n```\n```\nif request.tokenOut == feeToken:\n    amountOut = _convert(\n        request.tokenIn,\n        request.tokenOut,\n        amountIn,\n        MathUpgradeable.Rounding.Down,\n        request.price,\n        request.priceBase,\n        request.quoteToken\n    )\n    fee = _getFeeByAmountWithFee(amountOut, request.feeNumerator, request.feeBase)\n    amountOut -= fee\n```\n```\nfunction _convertByFromPrice(\n    address fromToken,\n    address toToken,\n    uint256 fromAmount,\n    MathUpgradeable.Rounding rounding,\n    uint256 price,\n    uint256 priceBase\n) internal view virtual returns (uint256) {\n    uint256 fromBase = 10 ** IERC20Metadata(fromToken).decimals();\n    uint256 toBase = 10 ** IERC20Metadata(toToken).decimals();\n\n    return fromAmount.mulDiv(price * toBase, priceBase * fromBase, rounding);\n}\n```
MEDIUM severity: The `FundingScript` and `RedemptionScript` in the provided code utilize the `mload` instruction to c. The `FundingScript` and `RedemptionScript` in the provided code utilize the `mload` instruction to cast the initial bytes of a byte array to a `bytes4` value. This operation is performed to extract the function signature from the `_extraData` variable. However, since `mload` operates on 32-byte chun...

Vulnerable code:
```\nbytes4 functionSignature;\nassembly {\n    functionSignature := mload(add(_extraData, 0x20))\n}\nrequire(\n    functionSignature == vendingMachine.unqualifiedDepositToTbtc.selector,\n    "Bad _extraData signature. Call must be to unqualifiedDepositToTbtc."\n);\n```\n```\nbytes4 functionSignature;\nassembly {\n    functionSignature := mload(add(_extraData, 0x20))\n}\nrequire(\n    functionSignature == vendingMachine.tbtcToBtc.selector,\n    "Bad _extraData signature. Call must be to tbtcToBtc."\n);\n```
MEDIUM severity: The `checkReentrancy` function in the `BalancerUtilities.sol` contract is designed to detect reentra. The `checkReentrancy` function in the `BalancerUtilities.sol` contract is designed to detect reentrancy attacks by performing a `staticcall` on the pool contract. However, due to incorrect usage of `staticcall`, the function inadvertently burns up all the gas allocated for the call. This is because...

Vulnerable code:
```\nfunction testAttack() public {\n    mockRootPrice(WSTETH, 1_123_300_000_000_000_000); // wstETH\n    mockRootPrice(CBETH, 1_034_300_000_000_000_000); // cbETH\n\n    IBalancerMetaStablePool pool = IBalancerMetaStablePool(WSTETH_CBETH_POOL);\n\n    address[] memory assets = new address[](2);\n    assets[0] = WSTETH;\n    assets[1] = CBETH;\n    uint256[] memory amounts = new uint256[](2);\n    amounts[0] = 10_000 ether;\n    amounts[1] = 0;\n\n    IBalancerVault.JoinPoolRequest memory joinRequest = IBalancerVault.JoinPoolRequest({\n        assets: assets,\n        maxAmountsIn: amounts, // maxAmountsIn,\n        userData: abi.encode(\n            IBalancerVault.JoinKind.EXACT_TOKENS_IN_FOR_BPT_OUT,\n            amounts, // maxAmountsIn,\n            0\n        ),\n        fromInternalBalance: false\n    });\n\n    IBalancerVault.SingleSwap memory swapRequest = IBalancerVault.SingleSwap({\n        poolId: 0x9c6d47ff73e0f5e51be5fd53236e3f595c5793f200020000000000000000042c,\n        kind: IBalancerVault.SwapKind.GIVEN_IN,\n        assetIn: WSTETH,\n        assetOut: CBETH,\n        amount: amounts[0],\n        userData: abi.encode(\n            IBalancerVault.JoinKind.EXACT_TOKENS_IN_FOR_BPT_OUT,\n            amounts, // maxAmountsIn,\n            0\n        )\n    });\n\n    IBalancerVault.FundManagement memory funds = IBalancerVault.FundManagement({\n        sender: address(this),\n        fromInternalBalance: false,\n        recipient: payable(address(this)),\n        toInternalBalance: false\n    });\n\n    emit log_named_uint("Gas before price1", gasleft());\n    uint256 price1 = oracle.getPriceInEth(WSTETH_CBETH_POOL);\n    emit log_named_uint("price1", price1);\n    emit log_named_uint("Gas after price1", gasleft());\n}\n```\n```\n[PASS] testAttack() (gas: 9203730962297323943)\nLogs:\nGas before price1: 9223372036854745204\nprice1: 1006294352158612428\nGas after price1: 425625349158468958\n```
MEDIUM severity: The vulnerability arises from the incorrect handling of compound cancellation, which leads to the co. The vulnerability arises from the incorrect handling of compound cancellation, which leads to the contract becoming stuck in a `compound_failed` status. This occurs when the `compound` function is invoked by the keeper to swap a token held by the contract for TokenA or TokenB and add it as liquidity...

Vulnerable code:
```\nfunction compound(GMXTypes.Store storage self, GMXTypes.CompoundParams memory cp) external {\n    if (self.tokenA.balanceOf(address(self.trove)) > 0) {\n        self.tokenA.safeTransferFrom(address(self.trove), address(this), self.tokenA.balanceOf(address(self.trove)));\n    }\n    if (self.tokenB.balanceOf(address(self.trove)) > 0) {\n        self.tokenB.safeTransferFrom(address(self.trove), address(this), self.tokenB.balanceOf(address(self.trove)));\n    }\n\n    uint256 _tokenInAmt = IERC20(cp.tokenIn).balanceOf(address(this));\n\n    if (_tokenInAmt > 0) {\n        self.refundee = payable(msg.sender);\n        self.compoundCache.compoundParams = cp;\n        ISwap.SwapParams memory _sp;\n        _sp.tokenIn = cp.tokenIn;\n        _sp.tokenOut = cp.tokenOut;\n        _sp.amountIn = _tokenInAmt;\n        _sp.amountOut = 0;\n        _sp.slippage = self.minSlippage;\n        _sp.deadline = cp.deadline;\n        GMXManager.swapExactTokensForTokens(self, _sp);\n        GMXTypes.AddLiquidityParams memory _alp;\n        _alp.tokenAAmt = self.tokenA.balanceOf(address(this));\n        _alp.tokenBAmt = self.tokenB.balanceOf(address(this));\n        self.compoundCache.depositValue = GMXReader.convertToUsdValue(self, address(self.tokenA), self.tokenA.balanceOf(address(this))) + GMXReader.convertToUsdValue(self, address(self.tokenB), self.tokenB.balanceOf(address(this)));\n        GMXChecks.beforeCompoundChecks(self);\n        self.status = GMXTypes.Status.Compound;\n        _alp.minMarketTokenAmt = GMXManager.calcMinMarketSlippageAmt(self, self.compoundCache.depositValue, cp.slippage);\n        _alp.executionFee = cp.executionFee;\n        self.compoundCache.depositKey = GMXManager.addLiquidity(self, _alp);\n    }\n}\n```\n```\nfunction processCompoundCancellation(GMXTypes.Store storage self) external {\n    GMXChecks.beforeProcessCompoundCancellationChecks(self);\n    self.status = GMXTypes.Status.Compound_Failed;\n\n    emit CompoundCancelled();\n```\n```\nuint256 _tokenInAmt = IERC20(cp.tokenIn).balanceOf(address(this));\n\nif (_tokenInAmt > 0) {\n    // compound logic\n    // rest of code.\n}\n```
MEDIUM severity: The `MysteryBox::fulfillRandomWords()` function contains a critical flaw in its implementation, whic. The `MysteryBox::fulfillRandomWords()` function contains a critical flaw in its implementation, which allows the same request to be fulfilled multiple times. The function attempts to prevent this scenario by checking if the request has already been fulfilled, as indicated by the `fulfilled` property...

Vulnerable code:
```\nif (vrfRequests[_requestId].fulfilled) {\n    revert InvalidVrfState();\n}\n```
MEDIUM severity: The vulnerability, known as FlasherFTM - Unsolicited invocation of the callback (CREAM auth bypass),. The vulnerability, known as FlasherFTM - Unsolicited invocation of the callback (CREAM auth bypass), allows an attacker to bypass authentication checks in the `onFlashLoan` callback function of a Flash Loan provider contract. This is achieved by directly calling the `flashLoan` function of the `ICTo...

Vulnerable code:
```\n/**\n * @dev Routing Function for Flashloan Provider\n * @param info: struct information for flashLoan\n * @param _flashnum: integer identifier of flashloan provider\n */\nfunction initiateFlashloan(FlashLoan.Info calldata info, uint8 _flashnum) external isAuthorized override {\n    if (_flashnum == 0) {\n        _initiateGeistFlashLoan(info);\n    } else if (_flashnum == 2) {\n        _initiateCreamFlashLoan(info);\n    } else {\n        revert(Errors.VL_INVALID_FLASH_NUMBER);\n    }\n}\n```\n```\nmodifier isAuthorized() {\n    require(\n        msg.sender == _fujiAdmin.getController() ||\n        msg.sender == _fujiAdmin.getFliquidator() ||\n        msg.sender == owner(),\n        Errors.VL_NOT_AUTHORIZED\n    );\n}\n```\n```\n/**\n * @dev Initiates an CreamFinance flashloan.\n * @param info: data to be passed between functions executing flashloan logic\n */\nfunction _initiateCreamFlashLoan(FlashLoan.Info calldata info) internal {\n    address crToken = info.asset == _FTM\n       ? 0xd528697008aC67A21818751A5e3c58C8daE54696\n        : _crMappings.addressMapping(info.asset);\n\n    // Prepare data for flashloan execution\n    bytes memory params = abi.encode(info);\n\n    // Initialize Instance of Cream crLendingContract\n    ICTokenFlashloan(crToken).flashLoan(address(this), address(this), info.amount, params);\n}\n```\n```\naddress initiator\n```\n```\nfunction onFlashLoan(\n    address sender,\n    address underlying,\n    uint256 amount,\n    uint256 fee,\n    bytes calldata params\n) external override returns (bytes32) {\n    address crToken = underlying == _WFTM\n       ? 0xd528697008aC67A21818751A5e3c58C8daE54696\n        : _crMappings.addressMapping(underlying);\n    require(msg.sender == crToken && address(this) == sender, Errors.VL_NOT_AUTHORIZED);\n}\n```
MEDIUM severity: The vulnerability allows an attacker to create a pair of tokens that cannot be taken over by the `ta. The vulnerability allows an attacker to create a pair of tokens that cannot be taken over by the `takeOverPool()` function. This is achieved by exploiting the lack of input validation in the `createPair()` function, which accepts initial parameters for the pair without verifying their validity.\n\nB...

Vulnerable code:
```\nuint112 virtualEth = type(uint112).max;\nuint112 bootstrapEth = type(uint112).max;\nuint112 initialEth = type(uint112).max;\nuint112 initialTokenMatch = type(uint112).max;\n```\n```\nuint256 k = virtualEth * initialTokenMatch;\ntokenAmtForAmm = (k * bootstrapEth) / (totalEth * totalEth);\n```