Farseen0/scar-pairs huggingface dataset:
HIGH severity: BufferBinaryPool can permanently lock funds on early exercise. **Details**

[BufferBinaryOptions.sol#L380-L395](https://github.com/Buffer-Finance/Buffer-Protocol-v2_5/blob/84b6060b4447b2550de595202e8820c7f515988b/contracts/core/BufferBinaryOptions.sol#L380-L395)

        if (option.expiration > closingTime) {
            profit =
               ...

Vulnerable code:
uint256 transferTokenXAmount = tokenXAmount > ll.amount
? ll.amount
: tokenXAmount;
HIGH severity: Market direction signature can be abused if privateKeeperMode is disabled. **Details**

https://github.com/Buffer-Finance/Buffer-Protocol-v2_5/blob/84b6060b4447b2550de595202e8820c7f515988b/contracts/core/BufferRouter.sol#L233-L246

            if (
                !Validator.verifyMarketDirection(
                    params,
                   ...

Vulnerable code:
if (
!Validator.verifyMarketDirection(
params,
queuedTrade,
optionInfo.signer
)
) {
emit FailUnlock(
params.optionId,
params.targetContract,
"Router: Wrong market direction"
);
continue;
}
HIGH severity: closeAnytime timestamp is never validated against current timestamp. **Details**

[BufferRouter.sol#L248-L258](https://github.com/Buffer-Finance/Buffer-Protocol-v2_5/blob/84b6060b4447b2550de595202e8820c7f515988b/contracts/core/BufferRouter.sol#L248-L258)

            try
                optionsContract.unlock(
                   ...

Vulnerable code:
try
optionsContract.unlock(
params.optionId,
params.closingPrice,
publisherSignInfo.timestamp,
params.isAbove
)
{} catch Error(string memory reason) {
emit FailUnlock(params.optionId, params.targetContract, reason);
continue;
}
HIGH severity: Math error in Dynamo4626#\_claimable_fees_available will lead to fees or strategy lockup. **Details**

[Dynamo4626.vy#L428-L438](https://github.com/DynamoFinance/vault/blob/c331ffefadec7406829fc9f2e7f4ee7631bef6b3/contracts/Dynamo4626.vy#L428-L438)

    fee_percentage: uint256 = YIELD_FEE_PERCENTAGE
    if _yield == FeeType.PROPOSER:
        fee_percentage = PROPOSER_FEE_PERCENTAGE
   .....

Vulnerable code:
fee_percentage: uint256 = YIELD_FEE_PERCENTAGE
if _yield == FeeType.PROPOSER:
fee_percentage = PROPOSER_FEE_PERCENTAGE
elif _yield == FeeType.BOTH:
fee_percentage += PROPOSER_FEE_PERCENTAGE
elif _yield != FeeType.YIELD:
assert False, "Invalid FeeType!"
HIGH severity: MarketMaker.sol is vulnerable to inflation attacks. **Details**

[FundingMath.sol#L21-L37](https://github.com/SportsFI-UBet/ubet-contracts-v1/blob/2766b47bed2cf027e29053af2afc4d35256747a5/contracts/funding/FundingMath.sol#L21-L37)

     function calcFunding(uint256 collateralAdded, uint256 totalShares, uint256 poolValue)
        internal
       ...

Vulnerable code:
function calcFunding(uint256 collateralAdded, uint256 totalShares, uint256 poolValue)
internal
pure
returns (uint256 sharesMinted)
{
if (totalShares == 0) {
// funding when LP pool is empty
sharesMinted = collateralAdded;
} else {
// mint LP tokens proportional to how much value the new investment
// brings to the pool
HIGH severity: After migration, the old MarketFundingPool contract will fail to correctly distribute fees to new MarketFundingPool. **Details**

[FundingPool.sol#L135-L142](https://github.com/SportsFI-UBet/ubet-contracts-v1/blob/2766b47bed2cf027e29053af2afc4d35256747a5/contracts/funding/FundingPool.sol#L135-L142)

    function _beforeTokenTransfer(address from, address to, uint256 amount) internal override {
        if (from...

Vulnerable code:
function _beforeTokenTransfer(address from, address to, uint256 amount) internal override {
if (from != address(0)) {
// LP tokens being transferred away from a funder - any fees that
// have accumulated so far due to trading activity should be given
// to the original owner for the period of time he held the LP
// tokens
withdrawFees(from);
}
HIGH severity: Precision error in \_fetchTWAP causes vesting to be free after initial lockdrop period. **Details**

[BlueberryStaking.sol#L830-L843](https://github.com/Blueberryfi/blueberry-staking/blob/efaf7fc690e38914ba475d5ac61a4d0bd3f45c0d/src/BlueberryStaking.sol#L830-L843)

    // Adjust for decimals
    if (BLB_DECIMALS > _decimalsStable) {
        _priceX96 /= 10 ** (BLB_DECIMALS -...

Vulnerable code:
if (blbIsToken0) {
return FullMath.mulDiv(_priceX96, 10 ** (18 + BLB_DECIMALS stableDecimals), 2 ** 96);
} else {
uint256 inversePrice = FullMath.mulDiv(_priceX96, 10 ** (18 - BLB_DECIMALS + stableDecimals), 2 ** 96);
return 10**36 / inversePrice;
}
MEDIUM severity: It is impossible to complete any vest unless all vests are mature. **Details**

[BlueberryStaking.sol#L328-L331](https://github.com/Blueberryfi/blueberry-staking/blob/efaf7fc690e38914ba475d5ac61a4d0bd3f45c0d/src/BlueberryStaking.sol#L328-L331)

    uint256 vestIndexLength = vests.length;
    if (vesting[msg.sender].length < vestIndexLength) {
        revert...

Vulnerable code:
uint256 vestIndexLength = vests.length;
if (vesting[msg.sender].length < vestIndexLength) {
revert InvalidLength();
}
MEDIUM severity: Rewards will be permanently lost for ibToken with no deposits. **Details**

[BlueberryStaking.sol#L482-L485](https://github.com/Blueberryfi/blueberry-staking/blob/efaf7fc690e38914ba475d5ac61a4d0bd3f45c0d/src/BlueberryStaking.sol#L482-L485)

    function rewardPerToken(address _ibToken) public view returns (uint256) {
        if (totalSupply[_ibToken] == 0)...

Vulnerable code:
function rewardPerToken(address _ibToken) public view returns (uint256) {
if (totalSupply[_ibToken] == 0) {
return rewardPerTokenStored[_ibToken];
}
HIGH severity: Malicious proposer can use pregen_info to drain vault assets through sandwich attack. **Details**

[AdapterVault.vy#L662](https://github.com/adapter-fi/AdapterVault/blob/3c2895a69ad5eb2c4be16d454f63a6f2f074f351/contracts/AdapterVault.vy#L662)

    self._balanceAdapters(claim_amount, pregen_info)

When claiming fees, funds must be removed from adapters to pay the...

Vulnerable code:
pg: PregenInfo = empty(PregenInfo)
if len(pregen_info) > 0:
pg = _abi_decode(pregen_info, PregenInfo)
else:
#Info not provided, compute it expensively
pg.approx_params_swapExactYtForPt = self.default_approx_params()
pg.approx_params_swapExactTokenForPt = self.default_approx_params()
ytToPTL: uint256 = 0
pg.mint_returns, ytToPTL = self.estimate_mint_returns(asset_amount)
pg.spot_returns = self.estimate_spot_returns(asset_amount)
#we already paid the tax... why not reuse it...
pg.approx_params_swapExactTokenForPt.guessOffchain = pg.spot_returns
pg.approx_params_swapExactYtForPt.guessOffchain = ytToPTL
HIGH severity: Failure to pass \_withdraw_only to \_getBalanceTXs allows any withdrawing user to drain vault assets through sandwich attack. **Details**

[AdapterVault.vy#L1045-L1060](https://github.com/adapter-fi/AdapterVault/blob/3c2895a69ad5eb2c4be16d454f63a6f2f074f351/contracts/AdapterVault.vy#L1045-L1060)

    def _balanceAdapters( _target_asset_balance: uint256, pregen_info: DynArray[Bytes[4096], MAX_ADAPTERS], _withdraw_only :...

Vulnerable code:
def _balanceAdapters( _target_asset_balance: uint256, pregen_info: DynArray[Bytes[4096], MAX_ADAPTERS], _withdraw_only : bool = False, _max_txs: uint8 = MAX_BALTX_DEPOSIT ):
# Make sure we have enough assets to send to _receiver.
txs: BalanceTX[MAX_ADAPTERS] = empty(BalanceTX[MAX_ADAPTERS])
blocked_adapters: address[MAX_ADAPTERS] = empty(address[MAX_ADAPTERS])

# Setup current state of vault & adapters & strategy.
d4626_assets: uint256 = 0
adapter_states: BalanceAdapter[MAX_ADAPTERS] = empty(BalanceAdapter[MAX_ADAPTERS])
total_assets: uint256 = 0
total_ratios: uint256 = 0
d4626_assets, adapter_states, total_assets, total_ratios = self._getCurrentBalances()

def _getBalanceTxs( _target_asset_balance: uint256, _max_txs: uint8, _min_proposer_payout: uint256, _total_assets: uint256, _total_ratios: uint256, _adapter_states: BalanceAdapter[MAX_ADAPTERS], _withdraw_only : bool = False) -> (BalanceTX[MAX_ADAPTERS], address[MAX_ADAPTERS]):
current_local_asset_balance : uint256 = ERC20(asset).balanceOf(self)
return FundsAllocator(self.funds_allocator).getBalanceTxs( current_local_asset_balance, _target_asset_balance, _max_txs, _min_proposer_payout, _total_assets, _total_ratios, _adapter_states, _withdraw_only)
MEDIUM severity: ADAPTER_BREAKS_LOSS_POINT is too tight for volatile assets leading to near constant adapter blocking. **Details**

[FundsAllocator.vy#L14](https://github.com/adapter-fi/AdapterVault/blob/3c2895a69ad5eb2c4be16d454f63a6f2f074f351/contracts/FundsAllocator.vy#L14)

    ADAPTER_BREAKS_LOSS_POINT : constant(decimal) = 0.00001

As seen above the stop loss point has been set exceedingly...

Vulnerable code:
adapter_brakes_limit : uint256 = adapter.last_value - convert(convert(adapter.last_value, decimal) * ADAPTER_BREAKS_LOSS_POINT, uint256)
if adapter.current < adapter_brakes_limit:
# We've lost value in this adapter! Don't give it more money!
blocked_adapters[blocked_pos] = adapter.adapter
blocked_pos += 1
adapter.delta = 0 # This will result in no tx being generated.
MEDIUM severity: Withdraw and deposit methodology leads to valuation exploits under certain circumstances. **Details**

[FundsAllocator.vy#L107-L117](https://github.com/adapter-fi/AdapterVault/blob/3c2895a69ad5eb2c4be16d454f63a6f2f074f351/contracts/FundsAllocator.vy#L107-L117)

    for pos in range(MAX_ADAPTERS):
        adapter : BalanceAdapter = _adapter_balances[pos]
        if adapter.adapter ==...

Vulnerable code:
elif adapter.current > 0:
withdraw : uint256 = min(target_withdraw_balance, adapter.current)
target_withdraw_balance = target_withdraw_balance - withdraw
adapter.delta = convert(withdraw, int256) * -1

if adapter.delta != 0:
adapter_assets_allocated += convert(adapter.delta * -1, uint256)    # TODO : eliminate adapter_assets_allocated if never used.
d4626_delta += adapter.delta * -1
tx_count += 1
MEDIUM severity: PT donation attack will DOS spell deposit permanently. **Details**

[PendleSpell.sol#L128-L137](https://github.com/Blueberryfi/blueberry-core/blob/d0ed24769704cf5d9a8b0616cf534f29db32f6ca/contracts/spell/PendleSpell.sol#L128-L137)

    (uint256 ptAmount, , ) = IPendleRouter(_pendleRouter).swapExactTokenForPt(
        address(this),
       ...

Vulnerable code:
(uint256 ptAmount, , ) = IPendleRouter(_pendleRouter).swapExactTokenForPt(
address(this),
market,
minPtOut,
params,
input,
limitOrder
);
LOW severity: Events in BatchBet can be spoofed using custom pool/market. **Details**

[BatchBet.sol#L89-L111](https://github.com/SportsFI-UBet/ubet-contracts-v1/blob/7b61ff6631091056be51bf0bd88377560f6986f7/contracts/markets/BatchBet.sol#L89-L111)

        for (uint256 i = 0; i < buys.length; i++) {
    @>      address market = buys[i].market;

            if...

Vulnerable code:
(, uint256 feeAmount,) = IMarketMakerV1_2(market).buyFor(
buyer,
buys[i].investmentAmount,
buys[i].outcomeIndex,
buys[i].minOutcomeTokensToBuy,
extraFeeDecimal,
feeProfileId
);
totalFees += feeAmount;
}

if (totalInvestment > 0 && (data.length > 0 || affiliate != address(0x0))) {
@>      emit BuyWithData(buyer, affiliate, address(token), totalInvestment, data);
}
HIGH severity: BloomPool#redeemBorrower fails to decrement \_idToTotalBorrowed leading to large portions of borrower funds being permanently trapped in the contract. **Details**

[BloomPool.sol#L133-L136](https://github.com/Blueberryfi/bloom-v2/blob/87a60380331cc914be41ad57691f08b532a4d6fb/src/BloomPool.sol#L133-L136)

    uint256 totalBorrowAmount = _idToTotalBorrowed[id];
    uint256 borrowAmount = _borrowerAmounts[msg.sender][id];

    reward =...

Vulnerable code:
_idToCollateral[id].assetAmount -= uint128(reward);
_tbyBorrowerReturns[id] -= reward;
_borrowerAmounts[msg.sender][id] -= borrowAmount;
HIGH severity: BloomPool#\_normalize price will cause severe mis-pricing for RWAs that are not 18 dp. **Details**

[BloomPool.sol#L349-L351](https://github.com/Blueberryfi/bloom-v2/blob/87a60380331cc914be41ad57691f08b532a4d6fb/src/BloomPool.sol#L349-L351)

    uint256 totalValue = (existingCollateral.mulWad(startPrice) + amount.mulWad(currentPrice)) / _rwaScalingFactor;
    uint256 totalCollateral.....

Vulnerable code:
uint256 totalValue = (existingCollateral.mulWad(startPrice) + amount.mulWad(currentPrice)) / _rwaScalingFactor;
uint256 totalCollateral = existingCollateral + amount;
return uint128(totalValue.divWad(totalCollateral));
HIGH severity: Malicious borrower can repeatedly fill then kill orders to permanently lock funds of lenders and other borrowers. **Details**

[Orderbook.sol#L118-L133](https://github.com/Blueberryfi/bloom-v2/blob/87a60380331cc914be41ad57691f08b532a4d6fb/src/Orderbook.sol#L118-L133)

    function killBorrowerMatch(address lender) external returns (uint256 lenderAmount, uint256 borrowerReturn) {
        MatchOrder[] storage...

Vulnerable code:
uint256 len = matches.length;
for (uint256 i = 0; i != len; ++i) {
if (matches[i].borrower == msg.sender) {
lenderAmount = uint256(matches[i].lCollateral);
borrowerReturn = uint256(matches[i].bCollateral);
// Zero out the match order to preserve the array's order
matches[i] = MatchOrder({lCollateral: 0, bCollateral: 0, borrower: address(0)});
// Decrement the matched depth and open move the lenders collateral to an open order.
_matchedDepth -= lenderAmount;
_openOrder(lender, lenderAmount);
break;
}
}

if (remainingAmount != 0) {
uint256 amountToRemove = Math.min(remainingAmount, matches[index].lCollateral);
uint256 borrowAmount = uint256(matches[index].bCollateral);

if (amountToRemove != matches[index].lCollateral) {
borrowAmount = amountToRemove.divWad(_leverage);
matches[index].lCollateral -= uint128(amountToRemove);
matches[index].bCollateral -= uint128(borrowAmount);
}
remainingAmount -= amountToRemove;
_idleCapital[matches[index].borrower] += borrowAmount;
HIGH severity: Yield spread cannot be decrease without causing significant loss to the stUSDC pool. **Details**

[StUsdc.sol#L313-L324](https://github.com/stakeup-protocol/stakeup-contracts/blob/b4d8a83e9455efb8c7543a0fc62b5aea598c7f49/src/token/StUsdc.sol#L313-L324)

    function _liveTbyValue(IBloomPool pool) internal view returns (uint256 value) {
        uint256 startingId =...

Vulnerable code:
function _liveTbyValue(IBloomPool pool) internal view returns (uint256 value) {
uint256 startingId = lastRedeemedTbyId();
// Because we start at type(uint256).max, we need to increment and overflow to 0.
unchecked {
startingId++;
}
uint256 lastMintedId = pool.lastMintedId();
if (lastMintedId == type(uint256).max) return 0;
for (uint256 i = startingId; i <= lastMintedId; ++i) {
value += pool.getRate(i).mulWad(_tby.balanceOf(address(this), i)); <- @audit rate pulled from bloomPool.sol
}
}

function getRate(uint256 id) public view override returns (uint256) {
TbyMaturity memory maturity = _idToMaturity[id];
RwaPrice memory rwaPrice = _tbyIdToRwaPrice[id];

// If the TBY has matured, and is eligible for redemption, calculate the rate based on the end price.
uint256 price = rwaPrice.endPrice != 0 ? rwaPrice.endPrice : _rwaPrice();
uint256 rate = (uint256(price).divWad(uint256(rwaPrice.startPrice)));
return _takeSpread(rate); <- @audit rate is dependent on spread
}
HIGH severity: The yield distribution methodology for stUSDC#poke will lead to substantial loss of yield due to MEV for both stUSDC and StakeUpStaking. **Details**

[StUsdc.sol#L166-L185](https://github.com/stakeup-protocol/stakeup-contracts/blob/b4d8a83e9455efb8c7543a0fc62b5aea598c7f49/src/token/StUsdc.sol#L166-L185)

    uint256 globalShares_ = _globalShares;
    uint256 protocolValue = _protocolValue(pool);
    uint256 newUsdPerShare =...

Vulnerable code:
uint256 globalShares_ = _globalShares;
uint256 protocolValue = _protocolValue(pool);
uint256 newUsdPerShare = protocolValue.divWad(globalShares_);
uint256 lastUsdPerShare = _lastUsdPerShare;

if (newUsdPerShare > lastUsdPerShare) {
uint256 yieldPerShare = newUsdPerShare - lastUsdPerShare;
// Calculate performance fee
uint256 fee = _calculateFee(yieldPerShare, globalShares_);
// Calculate the new total value of the protocol for users
uint256 userValue = protocolValue - fee;
newUsdPerShare = userValue.divWad(globalShares_);
// Update state to distribute yield to users
_setUsdPerShare(newUsdPerShare);
// Process fee to StakeUpStaking
_processFee(fee);
} else if (newUsdPerShare < lastUsdPerShare) {
// If the protocol has lost value, we need to update the USD per share to reflect the loss.
_setUsdPerShare(newUsdPerShare);
}
HIGH severity: Shares of stUSDC can be lost/gained during cross chain transfers due to differing conversion rates across chains. **Details**

[StUsdcLite.sol#L418-L428](https://github.com/stakeup-protocol/stakeup-contracts/blob/b4d8a83e9455efb8c7543a0fc62b5aea598c7f49/src/token/StUsdcLite.sol#L418-L428)

    function _debit(uint256 _amountLD, uint256 _minAmountLD, uint32 _dstEid)
        internal
        override
       ...

Vulnerable code:
function _debit(uint256 _amountLD, uint256 _minAmountLD, uint32 _dstEid)
internal
override
returns (uint256 amountSentLD, uint256 amountReceivedLD)
{
(amountSentLD, amountReceivedLD) = _debitView(_amountLD, _minAmountLD, _dstEid);

uint256 shares = sharesByUsd(amountSentLD);
_burnShares(msg.sender, shares);
_setTotalUsd(_getTotalUsd() - amountSentLD);
}

function _credit(address _to, uint256 _amountToCreditLD, uint32 /*_srcEid*/ )
internal
override
returns (uint256 amountReceivedLD)
{
_mintShares(_to, sharesByUsd(_amountToCreditLD));
_setTotalUsd(_getTotalUsd() + _amountToCreditLD);
return _amountToCreditLD;
}
HIGH severity: SUP rewards will be completely lost when depositing TBYs to stUSDC via wstUSDC. **Details**

[StUsdc.sol#L118-L130](https://github.com/stakeup-protocol/stakeup-contracts/blob/b4d8a83e9455efb8c7543a0fc62b5aea598c7f49/src/token/StUsdc.sol#L118-L130)

    function depositTby(uint256 tbyId, uint256 amount) external nonReentrant returns (uint256 amountMinted) {
        IBloomPool...

Vulnerable code:
function depositTby(uint256 tbyId, uint256 amount) external nonReentrant returns (uint256 amountMinted) {
IBloomPool pool = _bloomPool;
require(amount > 0, Errors.ZeroAmount());
require(!pool.isTbyRedeemable(tbyId), Errors.RedeemableTbyNotAllowed());
// If the token is a TBY, we need to get the current exchange rate of the token
//     to accurately calculate the amount of stUsdc to mint.
amountMinted = pool.getRate(tbyId).mulWad(amount) * _scalingFactor;
_deposit(amountMinted);
_mintRewards(amountMinted);

emit TbyDeposited(msg.sender, tbyId, amount, amountMinted);
_tby.safeTransferFrom(msg.sender, address(this), tbyId, amount, "");
}

function depositTby(uint256 tbyId, uint256 amount) external override returns (uint256 amountMinted) {
_tby.safeTransferFrom(msg.sender, address(this), tbyId, amount, "");
amountMinted = _stUsdc.depositTby(tbyId, amount);
amountMinted = _mintWstUsdc(amountMinted);
}
HIGH severity: TBY#burn incorrectly burns id 0 for all burns causing complete loss of funds for lenders. **Details**

[Tby.sol#L78-L82](https://github.com/Blueberryfi/bloom-v2/blob/87a60380331cc914be41ad57691f08b532a4d6fb/src/token/Tby.sol#L78-L82)

    function burn(uint256 id, address account, uint256 amount) external onlyBloom {
        _totalSupply[id] -= amount;
        _burn(account, 0,...

Vulnerable code:
function burn(uint256 id, address account, uint256 amount) external onlyBloom {
_totalSupply[id] -= amount;
_burn(account, 0, amount);
emit Burn(account, id, amount);
}
MEDIUM severity: \_convertMatchOrders will fail to function properly for lenders if any borrower has canceled a matched order. **Details**

    function killBorrowerMatch(address lender) external returns (uint256 lenderAmount, uint256 borrowerReturn) {
        MatchOrder[] storage matches = _userMatchedOrders[lender];

        uint256 len = matches.length;
        for (uint256 i = 0; i != len; ++i) {
            if...

Vulnerable code:
uint256 len = matches.length;
for (uint256 i = 0; i != len; ++i) {
if (matches[i].borrower == msg.sender) {
lenderAmount = uint256(matches[i].lCollateral);
borrowerReturn = uint256(matches[i].bCollateral);
// Zero out the match order to preserve the array's order
matches[i] = MatchOrder({lCollateral: 0, bCollateral: 0, borrower: address(0)});
// Decrement the matched depth and open move the lenders collateral to an open order.
_matchedDepth -= lenderAmount;
_openOrder(lender, lenderAmount);
break;
}
}

uint256 length = matches.length;
for (uint256 i = length; i != 0; --i) {
uint256 index = i - 1;

if (remainingAmount != 0) {
(uint256 lenderFunds, uint256 borrowerFunds) =
_calculateRemovalAmounts(remainingAmount, matches[index].lCollateral, matches[index].bCollateral);
uint256 amountToRemove = lenderFunds + borrowerFunds;
MEDIUM severity: In the event of a partial match inside \_convertMatchOrders, borrower funds will be over-allocated. **Details**

[BloomPool.sol#L399-L403](https://github.com/Blueberryfi/bloom-v2/blob/87a60380331cc914be41ad57691f08b532a4d6fb/src/BloomPool.sol#L399-L403)

    if (lenderFunds == matches[index].lCollateral) {
        matches.pop();
    } else {
        matches[index].lCollateral -=...

Vulnerable code:
if (lenderFunds == matches[index].lCollateral) {
matches.pop();
} else {
matches[index].lCollateral -= uint128(lenderFunds);
}
MEDIUM severity: Using address rather than bytes32 for destinationAddress in wstUsdcBridge#bridgeWstUsdc causes incompatibility with chains that utilize 32 byte addresses. **Details**

[WstUsdcBridge.sol#L44-L49](https://github.com/stakeup-protocol/stakeup-contracts/blob/b4d8a83e9455efb8c7543a0fc62b5aea598c7f49/src/messaging/WstUsdcBridge.sol#L44-L49)

    function bridgeWstUsdc(
        address destinationAddress, <- @audit uses address instead of bytes32
       ...

Vulnerable code:
function bridgeWstUsdc(
address destinationAddress, <- @audit uses address instead of bytes32
uint256 wstUsdcAmount,
uint32 dstEid,
LzSettings calldata settings
) external payable returns (LzBridgeReceipt memory bridgingReceipt) {
MEDIUM severity: stUSDC#deposit compares current tby price with potentially stale pool price which can lead to small yield loss for pool. **Details**

[StUsdc.sol#L154-L157](https://github.com/stakeup-protocol/stakeup-contracts/blob/b4d8a83e9455efb8c7543a0fc62b5aea598c7f49/src/token/StUsdc.sol#L154-L157)

    function poke() external nonReentrant {
        uint256 currentTimestamp = block.timestamp;
        uint256 lastUpdate =...

Vulnerable code:
function poke() external nonReentrant {
uint256 currentTimestamp = block.timestamp;
uint256 lastUpdate = _lastRateUpdate;
if (currentTimestamp - lastUpdate < 24 hours) return;

function depositTby(uint256 tbyId, uint256 amount) external nonReentrant returns (uint256 amountMinted) {
IBloomPool pool = _bloomPool;
require(amount > 0, Errors.ZeroAmount());
require(!pool.isTbyRedeemable(tbyId), Errors.RedeemableTbyNotAllowed());
// If the token is a TBY, we need to get the current exchange rate of the token
//     to accurately calculate the amount of stUsdc to mint.
amountMinted = pool.getRate(tbyId).mulWad(amount) * _scalingFactor;
_deposit(amountMinted);
_mintRewards(amountMinted);

emit TbyDeposited(msg.sender, tbyId, amount, amountMinted);
_tby.safeTransferFrom(msg.sender, address(this), tbyId, amount, "");
}
MEDIUM severity: In the event of yield loss, yield will be double counted leading to excess fees. **Details**

[StUsdc.sol#L171-L181](https://github.com/stakeup-protocol/stakeup-contracts/blob/b4d8a83e9455efb8c7543a0fc62b5aea598c7f49/src/token/StUsdc.sol#L171-L181)

    if (newUsdPerShare > lastUsdPerShare) {
        uint256 yieldPerShare = newUsdPerShare - lastUsdPerShare;
        //...

Vulnerable code:
if (newUsdPerShare > lastUsdPerShare) {
uint256 yieldPerShare = newUsdPerShare - lastUsdPerShare;
// Calculate performance fee
uint256 fee = _calculateFee(yieldPerShare, globalShares_);
// Calculate the new total value of the protocol for users
uint256 userValue = protocolValue - fee;
newUsdPerShare = userValue.divWad(globalShares_);
// Update state to distribute yield to users
_setUsdPerShare(newUsdPerShare);
// Process fee to StakeUpStaking
_processFee(fee);