Farseen0/scar-pairs huggingface dataset:
HIGH severity: Vulnerable function: ```\nFile: BalancerSpotPrice.sol\n    function _calculateStableMathSpotPrice(\n..SNIP..\n        // . ```\nFile: BalancerSpotPrice.sol\n    function _calculateStableMathSpotPrice(\n..SNIP..\n        // Apply scale factors\n        uint256 secondary = balances[index2] * scalingFactors[index2] / BALANCER_PRECISION;\n\n        uint256 invariant = StableMath._calculateInvariant(\n            ampParam, S

Vulnerable code:
```\nFile: BalancerSpotPrice.sol\n    function _calculateStableMathSpotPrice(\n..SNIP..\n        // Apply scale factors\n        uint256 secondary = balances[index2] * scalingFactors[index2] / BALANCER_PRECISION;\n\n        uint256 invariant = StableMath._calculateInvariant(\n            ampParam, StableMath._balances(scaledPrimary, secondary), true // round up\n        );\n\n        spotPrice = StableMath._calcSpotPrice(ampParam, invariant, scaledPrimary, secondary);\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction gulp(uint256 \_minRewardAmount) external onlyEOAorWhitelist nonReentrant\n{\n uint256 . ```\nfunction gulp(uint256 \_minRewardAmount) external onlyEOAorWhitelist nonReentrant\n{\n uint256 \_pendingReward = \_getPendingReward();\n if (\_pendingReward > 0) {\n  \_withdraw(0);\n }\n uint256 \_\_totalReward = Transfers.\_getBalance(rewardToken);\n (uint256 \_feeReward, uint256 \_retainedRe

Vulnerable code:
```\nfunction gulp(uint256 \_minRewardAmount) external onlyEOAorWhitelist nonReentrant\n{\n uint256 \_pendingReward = \_getPendingReward();\n if (\_pendingReward > 0) {\n  \_withdraw(0);\n }\n uint256 \_\_totalReward = Transfers.\_getBalance(rewardToken);\n (uint256 \_feeReward, uint256 \_retainedReward) = \_capFeeAmount(\_\_totalReward.mul(performanceFee) / 1e18);\n Transfers.\_pushFunds(rewardToken, buyback, \_feeReward);\n if (rewardToken != routingToken) {\n  require(exchange != address(0), "exchange not set");\n  uint256 \_totalReward = Transfers.\_getBalance(rewardToken);\n  \_totalReward = \_capTransferAmount(rewardToken, \_totalReward, \_retainedReward);\n  Transfers.\_approveFunds(rewardToken, exchange, \_totalReward);\n  IExchange(exchange).convertFundsFromInput(rewardToken, routingToken, \_totalReward, 1);\n }\n if (routingToken != reserveToken) {\n  require(exchange != address(0), "exchange not set");\n  uint256 \_totalRouting = Transfers.\_getBalance(routingToken);\n  \_totalRouting = \_capTransferAmount(routingToken, \_totalRouting, \_retainedReward);\n  Transfers.\_approveFunds(routingToken, exchange, \_totalRouting);\n  IExchange(exchange).joinPoolFromInput(reserveToken, routingToken, \_totalRouting, 1);\n }\n uint256 \_totalBalance = Transfers.\_getBalance(reserveToken);\n \_totalBalance = \_capTransferAmount(reserveToken, \_totalBalance, \_retainedReward);\n require(\_totalBalance >= \_minRewardAmount, "high slippage");\n \_deposit(\_totalBalance);\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nFile: TwoTokenPoolUtils.sol\n    /// @notice Gets the oracle price pair price between two token. ```\nFile: TwoTokenPoolUtils.sol\n    /// @notice Gets the oracle price pair price between two tokens using a weighted\n    /// average between a chainlink oracle and the balancer TWAP oracle.\n    /// @param poolContext oracle context variables\n    /// @param oracleContext oracle context variables

Vulnerable code:
```\nFile: TwoTokenPoolUtils.sol\n    /// @notice Gets the oracle price pair price between two tokens using a weighted\n    /// average between a chainlink oracle and the balancer TWAP oracle.\n    /// @param poolContext oracle context variables\n    /// @param oracleContext oracle context variables\n    /// @param tradingModule address of the trading module\n    /// @return oraclePairPrice oracle price for the pair in 18 decimals\n    function _getOraclePairPrice(\n        TwoTokenPoolContext memory poolContext,\n        OracleContext memory oracleContext, \n        ITradingModule tradingModule\n    ) internal view returns (uint256 oraclePairPrice) {\n        // NOTE: this balancer price is denominated in 18 decimal places\n        uint256 balancerWeightedPrice;\n        if (oracleContext.balancerOracleWeight > 0) {\n            uint256 balancerPrice = BalancerUtils._getTimeWeightedOraclePrice(\n                address(poolContext.basePool.pool),\n                IPriceOracle.Variable.PAIR_PRICE,\n                oracleContext.oracleWindowInSeconds\n            );\n\n            if (poolContext.primaryIndex == 1) {\n                // If the primary index is the second token, we need to invert\n                // the balancer price.\n                balancerPrice = BalancerConstants.BALANCER_PRECISION_SQUARED / balancerPrice;\n            }\n\n            balancerWeightedPrice = balancerPrice * oracleContext.balancerOracleWeight;\n        }\n\n        uint256 chainlinkWeightedPrice;\n        if (oracleContext.balancerOracleWeight < BalancerConstants.BALANCER_ORACLE_WEIGHT_PRECISION) {\n            (int256 rate, int256 decimals) = tradingModule.getOraclePrice(\n                poolContext.primaryToken, poolContext.secondaryToken\n            );\n            require(rate > 0);\n            require(decimals >= 0);\n\n            if (uint256(decimals) != BalancerConstants.BALANCER_PRECISION) {\n                rate = (rate * int256(BalancerConstants.BALANCER_PRECISION)) / decimals;\n            }\n\n            // No overflow in rate conversion, checked above\n            chainlinkWeightedPrice = uint256(rate) * \n                (BalancerConstants.BALANCER_ORACLE_WEIGHT_PRECISION - oracleContext.balancerOracleWeight);\n        }\n\n        oraclePairPrice = (balancerWeightedPrice + chainlinkWeightedPrice) / \n            BalancerConstants.BALANCER_ORACLE_WEIGHT_PRECISION;\n    }\n```\n
HIGH severity: Vulnerable function: ```\nfunction requestWithdrawal(uint256 \_tokensToWithdraw) external override {\n  WithdrawalStatus . ```\nfunction requestWithdrawal(uint256 \_tokensToWithdraw) external override {\n  WithdrawalStatus \_status = getWithdrawalStatus(msg.sender);\n\n  require(\_status == WithdrawalStatus.NONE || \_status == WithdrawalStatus.EXPIRED,\n    "PB: Can't request withdrawal");\n\n  uint256 \_daiTokensToWith

Vulnerable code:
```\nfunction requestWithdrawal(uint256 \_tokensToWithdraw) external override {\n  WithdrawalStatus \_status = getWithdrawalStatus(msg.sender);\n\n  require(\_status == WithdrawalStatus.NONE || \_status == WithdrawalStatus.EXPIRED,\n    "PB: Can't request withdrawal");\n\n  uint256 \_daiTokensToWithdraw = \_tokensToWithdraw.mul(getDAIToDAIxRatio()).div(PERCENTAGE\_100);\n  uint256 \_availableDaiBalance = balanceOf(msg.sender).mul(getDAIToDAIxRatio()).div(PERCENTAGE\_100);\n\n  if (block.timestamp < liquidityMining.getEndLMTime().add(neededTimeAfterLM)) {\n    \_availableDaiBalance = \_availableDaiBalance.sub(liquidityFromLM[msg.sender]);\n  }\n\n  require(totalLiquidity >= totalCoverTokens.add(\_daiTokensToWithdraw),\n    "PB: Not enough liquidity");\n\n  require(\_availableDaiBalance >= \_daiTokensToWithdraw, "PB: Wrong announced amount");\n\n  WithdrawalInfo memory \_newWithdrawalInfo;\n  \_newWithdrawalInfo.amount = \_tokensToWithdraw;\n  \_newWithdrawalInfo.readyToWithdrawDate = block.timestamp.add(withdrawalPeriod);\n\n  withdrawalsInfo[msg.sender] = \_newWithdrawalInfo;\n  emit RequestWithdraw(msg.sender, \_tokensToWithdraw, \_newWithdrawalInfo.readyToWithdrawDate);\n}\n```\n
MEDIUM severity: Vulnerable function: ```\n    function getRateFactor() internal view returns (uint) {\n        return (block.timestamp ==. ```\n    function getRateFactor() internal view returns (uint) {\n        return (block.timestamp == lastUpdated) ?\n            0 :\n            ((block.timestamp - lastUpdated)*1e18)\n            .mulWadUp(\n                rateModel.getBorrowRatePerSecond(\n                    asset.balanceOf(add

Vulnerable code:
```\n    function getRateFactor() internal view returns (uint) {\n        return (block.timestamp == lastUpdated) ?\n            0 :\n            ((block.timestamp - lastUpdated)*1e18)\n            .mulWadUp(\n                rateModel.getBorrowRatePerSecond(\n                    asset.balanceOf(address(this)),\n                    borrows\n                )\n            );\n    }\n```\n
HIGH severity: Vulnerable function: ```\nfunction ownerOf(uint256 tokenId) public view virtual override returns (address) {\n    return . ```\nfunction ownerOf(uint256 tokenId) public view virtual override returns (address) {\n    return _tokenOwners.get(tokenId, "ERC721: owner query for nonexistent token");\n}\n```\n

Vulnerable code:
```\nfunction ownerOf(uint256 tokenId) public view virtual override returns (address) {\n    return _tokenOwners.get(tokenId, "ERC721: owner query for nonexistent token");\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nFile: ks-elastic-sc/package.json\n\n    "@openzeppelin/contracts": "4.3.1",. ```\nFile: ks-elastic-sc/package.json\n\n    "@openzeppelin/contracts": "4.3.1",\n    "@openzeppelin/test-helpers": "0.5.6",\n    "@openzeppelin/contracts-upgradeable": "4.3.1",\n```\n

Vulnerable code:
```\nFile: ks-elastic-sc/package.json\n\n    "@openzeppelin/contracts": "4.3.1",\n    "@openzeppelin/test-helpers": "0.5.6",\n    "@openzeppelin/contracts-upgradeable": "4.3.1",\n```\n
HIGH severity: Vulnerable function: ```\nfunction \_convert(address token, uint256 amount, uint8 resolution, bool to) private view retur. ```\nfunction \_convert(address token, uint256 amount, uint8 resolution, bool to) private view returns (uint256 converted) {\n    uint8 decimals = IERC20(token).decimals();\n    uint256 diff = 0;\n    uint256 factor = 0;\n    converted = 0;\n    if (decimals > resolution) {\n        diff = uint256(d

Vulnerable code:
```\nfunction \_convert(address token, uint256 amount, uint8 resolution, bool to) private view returns (uint256 converted) {\n    uint8 decimals = IERC20(token).decimals();\n    uint256 diff = 0;\n    uint256 factor = 0;\n    converted = 0;\n    if (decimals > resolution) {\n        diff = uint256(decimals.sub(resolution));\n        factor = 10 \*\* diff;\n        if (to && amount >= factor) {\n            converted = amount.div(factor);\n        } else if (!to) {\n            converted = amount.mul(factor);\n        }\n    } else if (decimals < resolution) {\n        diff = uint256(resolution.sub(decimals));\n        factor = 10 \*\* diff;\n        if (to) {\n            converted = amount.mul(factor);\n        } else if (!to && amount >= factor) {\n            converted = amount.div(factor);\n        }\n    }\n}\n```\n
MEDIUM severity: Vulnerable function: ```\n                if (entitledShares > queue[index].assets) {\n              . ```\n                if (entitledShares > queue[index].assets) {\n                    // skip the rollover for the user if the assets cannot cover the relayer fee instead of revert.\n                    if (queue[index].assets < relayerFee) {\n                        index++;\n                      

Vulnerable code:
```\n                if (entitledShares > queue[index].assets) {\n                    // skip the rollover for the user if the assets cannot cover the relayer fee instead of revert.\n                    if (queue[index].assets < relayerFee) {\n                        index++;\n                        continue;\n                    }\n```\n
MEDIUM severity: Vulnerable function: ```\nif (!version.valid) context.latestPosition.local.invalidate(newPosition);\n. ```\nif (!version.valid) context.latestPosition.local.invalidate(newPosition);\nnewPosition.adjust(context.latestPosition.local);\n// rest of code\ncontext.latestPosition.local.update(newPosition);\n```\n

Vulnerable code:
```\nif (!version.valid) context.latestPosition.local.invalidate(newPosition);\nnewPosition.adjust(context.latestPosition.local);\n// rest of code\ncontext.latestPosition.local.update(newPosition);\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction \_beforeTokenTransfer(address from, address to, uint256 amount) internal override {\n . ```\nfunction \_beforeTokenTransfer(address from, address to, uint256 amount) internal override {\n    uint256 balanceFrom = (from != address(0)) ? balanceOf(from) : 0;\n    uint256 balanceTo = (from != address(0)) ? balanceOf(to) : 0;\n    uint256 newTotalSupply = totalSupply()\n        .add(from =

Vulnerable code:
```\nfunction \_beforeTokenTransfer(address from, address to, uint256 amount) internal override {\n    uint256 balanceFrom = (from != address(0)) ? balanceOf(from) : 0;\n    uint256 balanceTo = (from != address(0)) ? balanceOf(to) : 0;\n    uint256 newTotalSupply = totalSupply()\n        .add(from == address(0) ? amount : 0)\n        .sub(to == address(0) ? amount : 0);\n\n    ParamsHelper memory params = ParamsHelper({\n        from: from,\n        to: to,\n        amount: amount,\n        balanceFrom: balanceFrom,\n        balanceTo: balanceTo,\n        newTotalSupply: newTotalSupply\n    });\n```\n
MEDIUM severity: Vulnerable function: ```\n    function liquidate(\n        address _account,\n        uint256 _debtAmount,\n        uint2. ```\n    function liquidate(\n        address _account,\n        uint256 _debtAmount,\n        uint256 _minExchangeRate\n    ) external onlyLiquidator whenNotPaused updateReward(_account) returns (bool) {\n        if (_debtAmount == 0) revert wrongLiquidationAmount();\n\n        UserDetails memory a

Vulnerable code:
```\n    function liquidate(\n        address _account,\n        uint256 _debtAmount,\n        uint256 _minExchangeRate\n    ) external onlyLiquidator whenNotPaused updateReward(_account) returns (bool) {\n        if (_debtAmount == 0) revert wrongLiquidationAmount();\n\n        UserDetails memory accDetails = userDetails[_account];\n\n        // Since Taurus accounts' debt continuously decreases, liquidators may pass in an arbitrarily large number in order to\n        // request to liquidate the entire account.\n        if (_debtAmount > accDetails.debt) {\n            _debtAmount = accDetails.debt;\n        }\n\n        // Get total fee charged to the user for this liquidation. Collateral equal to (liquidated taurus debt value * feeMultiplier) will be deducted from the user's account.\n        // This call reverts if the account is healthy or if the liquidation amount is too large.\n        (uint256 collateralToLiquidate, uint256 liquidationSurcharge) = _calcLiquidation(\n            accDetails.collateral,\n            accDetails.debt,\n            _debtAmount\n        );\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction _stakeToken(uint _tokenId, uint _unlockTime) internal returns (uint) {\n  if (_unlockT. ```\nfunction _stakeToken(uint _tokenId, uint _unlockTime) internal returns (uint) {\n  if (_unlockTime > 0) {\n    unlockTime[_tokenId] = _unlockTime;\n    uint fullStakedTimeBonus = ((_unlockTime - block.timestamp) * stakingSettings.maxStakeBonusAmount) / stakingSettings.maxStakeBonusTime;\n    st

Vulnerable code:
```\nfunction _stakeToken(uint _tokenId, uint _unlockTime) internal returns (uint) {\n  if (_unlockTime > 0) {\n    unlockTime[_tokenId] = _unlockTime;\n    uint fullStakedTimeBonus = ((_unlockTime - block.timestamp) * stakingSettings.maxStakeBonusAmount) / stakingSettings.maxStakeBonusTime;\n    stakedTimeBonus[_tokenId] = _tokenId < 10000 ? fullStakedTimeBonus : fullStakedTimeBonus / 2;\n  }\n```\n
HIGH severity: Vulnerable function: ```\nuint256[] memory liens = LIEN_TOKEN.getLiens(tokenId);\nuint256 totalLienAm. ```\nuint256[] memory liens = LIEN_TOKEN.getLiens(tokenId);\nuint256 totalLienAmount = 0;\nif (liens.length > 0) {\n  for (uint256 i = 0; i < liens.length; ++i) {\n    uint256 payment;\n    uint256 lienId = liens[i];\n\n    ILienToken.Lien memory lien = LIEN_TOKEN.getLien(lienId);\n\n    if (transfe

Vulnerable code:
```\nuint256[] memory liens = LIEN_TOKEN.getLiens(tokenId);\nuint256 totalLienAmount = 0;\nif (liens.length > 0) {\n  for (uint256 i = 0; i < liens.length; ++i) {\n    uint256 payment;\n    uint256 lienId = liens[i];\n\n    ILienToken.Lien memory lien = LIEN_TOKEN.getLien(lienId);\n\n    if (transferAmount >= lien.amount) {\n      payment = lien.amount;\n      transferAmount -= payment;\n    } else {\n      payment = transferAmount;\n      transferAmount = 0;\n    }\n    if (payment > 0) {\n      LIEN_TOKEN.makePayment(tokenId, payment, lien.position, payer);\n    }\n  }\n} else {\n  //@audit-issue logic skipped if liens.length > 0\n  TRANSFER_PROXY.tokenTransferFrom(\n    weth,\n    payer,\n    COLLATERAL_TOKEN.ownerOf(tokenId),\n    transferAmount\n  );\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nreturn (amount_ * stethPerWsteth * stethUsd * decimalAdjustment) / (ohmEth . ```\nreturn (amount_ * stethPerWsteth * stethUsd * decimalAdjustment) / (ohmEth * ethUsd * 1e18);\n```\n

Vulnerable code:
```\nreturn (amount_ * stethPerWsteth * stethUsd * decimalAdjustment) / (ohmEth * ethUsd * 1e18);\n```\n
HIGH severity: Vulnerable function: ```\nPublicVault(VAULT()).decreaseYIntercept(\n  (expected - ERC20(underlying()). ```\nPublicVault(VAULT()).decreaseYIntercept(\n  (expected - ERC20(underlying()).balanceOf(address(this))).mulDivDown(\n    1e18 - withdrawRatio,\n    1e18\n  )\n);\n```\n

Vulnerable code:
```\nPublicVault(VAULT()).decreaseYIntercept(\n  (expected - ERC20(underlying()).balanceOf(address(this))).mulDivDown(\n    1e18 - withdrawRatio,\n    1e18\n  )\n);\n```\n
MEDIUM severity: Vulnerable function: ```\nif (amountToSwap > 0) {\n    swapPool = IUniswapV3Pool(vault.pool());\n    . ```\nif (amountToSwap > 0) {\n    swapPool = IUniswapV3Pool(vault.pool());\n    swapPool.swap(\n        address(this),\n        !isTokenA,\n        int256(amountToSwap),\n        isTokenA\n            ? UniV3WrappedLibMockup.MAX_SQRT_RATIO - 1 \n            : UniV3WrappedLibMockup.MIN_SQRT_RATIO + 1

Vulnerable code:
```\nif (amountToSwap > 0) {\n    swapPool = IUniswapV3Pool(vault.pool());\n    swapPool.swap(\n        address(this),\n        !isTokenA,\n        int256(amountToSwap),\n        isTokenA\n            ? UniV3WrappedLibMockup.MAX_SQRT_RATIO - 1 \n            : UniV3WrappedLibMockup.MIN_SQRT_RATIO + 1, \n        abi.encode(address(this))\n    );\n}\n```\n
HIGH severity: Vulnerable function: ```\n        (address[] memory tokens, uint256[] memory rewards) = IERC20Wrapper. ```\n        (address[] memory tokens, uint256[] memory rewards) = IERC20Wrapper(\n            pos.collToken\n        ).pendingRewards(pos.collId, pos.collateralSize);\n        for (uint256 i; i < tokens.length; i++) {\n            rewardsValue += oracle.getTokenValue(tokens[i], rewards[i]);\n      

Vulnerable code:
```\n        (address[] memory tokens, uint256[] memory rewards) = IERC20Wrapper(\n            pos.collToken\n        ).pendingRewards(pos.collId, pos.collateralSize);\n        for (uint256 i; i < tokens.length; i++) {\n            rewardsValue += oracle.getTokenValue(tokens[i], rewards[i]);\n        }\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction testGetFundingAmountPerSizeDelta() public{\n        uint result = MarketUtils.getFundi. ```\nfunction testGetFundingAmountPerSizeDelta() public{\n        uint result = MarketUtils.getFundingAmountPerSizeDelta(2e15, 1e15+1, true);\n        console2.log("result: %d", result);\n        uint256 correctResult = 2e15 * 1e15 * 1e30 + 1e15; // this is a real round up\n        correctResult = c

Vulnerable code:
```\nfunction testGetFundingAmountPerSizeDelta() public{\n        uint result = MarketUtils.getFundingAmountPerSizeDelta(2e15, 1e15+1, true);\n        console2.log("result: %d", result);\n        uint256 correctResult = 2e15 * 1e15 * 1e30 + 1e15; // this is a real round up\n        correctResult = correctResult/(1e15+1);\n        console2.log("correctResult: %d", correctResult);\n        assertTrue(result  == 1e15 * 1e30);\n    }\n```\n
HIGH severity: Vulnerable function: ```\n        uint256 safeOwnerCount = safe.getOwners().length;\n             if . ```\n        uint256 safeOwnerCount = safe.getOwners().length;\n             if (safeOwnerCount < minThreshold) {\n                 revert BelowMinThreshold(minThreshold, safeOwnerCount);\n        }\n```\n

Vulnerable code:
```\n        uint256 safeOwnerCount = safe.getOwners().length;\n             if (safeOwnerCount < minThreshold) {\n                 revert BelowMinThreshold(minThreshold, safeOwnerCount);\n        }\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction gas(uint256 _amountToLeave) internal view {\n    uint256 i = 0;\n    while (gasleft() . ```\nfunction gas(uint256 _amountToLeave) internal view {\n    uint256 i = 0;\n    while (gasleft() > _amountToLeave) {\n        ++i;\n    }\n}\n```\n

Vulnerable code:
```\nfunction gas(uint256 _amountToLeave) internal view {\n    uint256 i = 0;\n    while (gasleft() > _amountToLeave) {\n        ++i;\n    }\n}\n```\n
HIGH severity: Vulnerable function: ```\nfunction recoverStake(address \_operator) public {\n    uint256 operatorParams = operators[\_op. ```\nfunction recoverStake(address \_operator) public {\n    uint256 operatorParams = operators[\_operator].packedParams;\n    require(\n        block.number > operatorParams.getUndelegationBlock().add(undelegationPeriod),\n        "Can not recover stake before undelegation period is over."\n    );\

Vulnerable code:
```\nfunction recoverStake(address \_operator) public {\n    uint256 operatorParams = operators[\_operator].packedParams;\n    require(\n        block.number > operatorParams.getUndelegationBlock().add(undelegationPeriod),\n        "Can not recover stake before undelegation period is over."\n    );\n```\n
HIGH severity: Vulnerable function: ```\nfunction advancedPipe(AdvancedPipeCall[] calldata pipes, uint256 value)\n    external\n    paya. ```\nfunction advancedPipe(AdvancedPipeCall[] calldata pipes, uint256 value)\n    external\n    payable\n    returns (bytes[] memory results)\n{\n    results = IPipeline(PIPELINE).advancedPipe{value: value}(pipes);\n    LibEth.refundEth();\n}\n```\n

Vulnerable code:
```\nfunction advancedPipe(AdvancedPipeCall[] calldata pipes, uint256 value)\n    external\n    payable\n    returns (bytes[] memory results)\n{\n    results = IPipeline(PIPELINE).advancedPipe{value: value}(pipes);\n    LibEth.refundEth();\n}\n```\n