Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: The `Controller.calcAccountEquity` method is responsible for calculating the relative value of a use. The `Controller.calcAccountEquity` method is responsible for calculating the relative value of a user's supplied collateral and active borrow positions. This calculation involves iterating over a user's collateral and borrow positions, which are stored in arrays. The method performs two loops to cal...

Vulnerable code:
```\nuint256 collateralValuePerToken = underlyingPrice * exchangeRate * collateralFactor;\nuint256 collateralValue;\nuint256 sumCollateral = 0;\n\nuint256 _len = _accountData.collaterals.length();\nfor (uint256 i = 0; i < _len; i++) {\n    IiToken _token = IiToken(_accountData.collaterals.at(i));\n```\n```\nif (borrowValue = underlyingPrice * underlyingBorrowed / borrowFactor) {\n    sumBorrowed += borrowValue\n}\n\n_len = accountData.borrowed.length();\nfor (uint256 i = 0; i < _len; i++) {\n    IiToken _token = IiToken(accountData.borrowed.at(i));\n```
MEDIUM severity: The `RewardsInfo::voteRewardsCoefficient` variable, which determines the proportion of voting reward. The `RewardsInfo::voteRewardsCoefficient` variable, which determines the proportion of voting rewards, has an unintended side-effect when updated through the `GovSettings::editSettings` function. This function, accessible via an internal proposal, allows for the modification of settings without vali...

Vulnerable code:
```\nfunction _getInitialVotingRewards(\n    IGovPool.ProposalCore storage core,\n    IGovPool.VoteInfo storage voteInfo\n) internal view returns (uint256) {\n    (uint256 coreVotes, uint256 coreRawVotes) = \n        voteInfo.isVoteFor \n       ? (core.votesFor, core.rawVotesFor) \n        : (core.votesAgainst, core.rawVotesAgainst);\n\n    return \n        coreRawVotes.ratio(\n            core.settings.rewardsInfo.voteRewardsCoefficient, \n            PRECISION\n        ).ratio(\n            voteInfo.totalVoted, \n            coreVotes\n        );\n}\n```
MEDIUM severity: The vulnerability lies in the way the `ownerOf` function is implemented in the `NonfungiblePositionM. The vulnerability lies in the way the `ownerOf` function is implemented in the `NonfungiblePositionManager` contract. Specifically, when querying a nonexistent token, the function reverts, which can have severe consequences in certain scenarios.\n\nWhen a creditor's UniV3 position is maliciously bur...

Vulnerable code:
```\nfunction ownerOf(uint256 tokenId) public view virtual override returns (address) {\n    return _tokenOwners.get(tokenId);\n}\n```\n```\naddress creditor = underlyingPositionManager.ownerOf(loan.tokenId);\n_increaseLiquidity(cache.saleToken, cache.holdToken, loan, amount0, amount1);\n```\n```\nfor (uint256 i; i < loans.length; ) {\n    LoanInfo memory loan = loans[i];\n    address creditor = underlyingPositionManager.ownerOf(loan.tokenId);\n    if (creditor == msg.sender) {\n```
MEDIUM severity: The `onUndelegate` function in the `DefaultUndelegationPolicy` contract contains a vulnerability in . The `onUndelegate` function in the `DefaultUndelegationPolicy` contract contains a vulnerability in its validation logic. Specifically, it checks if the operator owner still holds at least `minimumSelfDelegationFraction` of the total supply after undelegation. However, the comparison is flawed becau...

Vulnerable code:
```\nfunction onUndelegate(address delegator, uint amount) external {\n    if (delegator!= owner) {\n        return;\n    }\n\n    uint actualAmount = amount < balanceOf(owner)? amount : balanceOf(owner); \n    uint balanceAfter = balanceOf(owner) - actualAmount;\n    uint totalSupplyAfter = totalSupply() - actualAmount;\n    require(1 ether * balanceAfter >= totalSupplyAfter * streamrConfig.minimumSelfDelegationFraction(), "error_selfDelegationTooLow");\n```
MEDIUM severity: The `iExecMaintenanceDelegate` contract utilizes a domain separator to comply with the EIP712 standa. The `iExecMaintenanceDelegate` contract utilizes a domain separator to comply with the EIP712 standard, a widely-used protocol for encoding and verifying digital signatures. However, a critical issue has been identified in the implementation of this domain separator. Specifically, the `version` fiel...

Vulnerable code:
```\nfunction _domain() internal view returns (IexecLibOrders_v5.EIP712Domain memory) {\n    return IexecLibOrders_v5.EIP712Domain({\n        name: "iExecODB",\n        version: "3.0-alpha",\n        chainId: _chainId(),\n        verifyingContract: address(this)\n    });\n}\n```
MEDIUM severity: The Mooniswap governance system relies on a liquidity voting mechanism, where the voting power of us. The Mooniswap governance system relies on a liquidity voting mechanism, where the voting power of users is derived from their stake in the system. Whenever the stake changes, the voting parameters need to be updated accordingly. The `_beforeTokenTransfer` function in the Mooniswap governance contrac...

Vulnerable code:
```\nfunction _beforeTokenTransfer(address from, address to, uint256 amount) internal override {\n    uint256 balanceFrom = (from!= address(0))? balanceOf(from) : 0;\n    uint256 balanceTo = (from!= address(0))? balanceOf(to) : 0;\n    uint256 newTotalSupply = totalSupply().add(from == address(0)? amount : 0).sub(to == address(0)? amount : 0);\n\n    ParamsHelper memory params = ParamsHelper({\n        from: from,\n        to: to,\n        amount: amount,\n        balanceFrom: balanceFrom,\n        balanceTo: balanceTo,\n        newTotalSupply: newTotalSupply\n    });\n\n    _updateOnTransfer(params, mooniswapFactoryGovernance.defaultFee, _emitFeeVoteUpdate, _fee);\n    _updateOnTransfer(params, mooniswapFactoryGovernance.defaultSlippageFee, _emitSlippageFeeVoteUpdate, _slippageFee);\n    _updateOnTransfer(params, mooniswapFactoryGovernance.defaultDecayPeriod, _emitDecayPeriodVoteUpdate, _decayPeriod);\n}\n```\n```\nif (params.from!= address(0)) {\n    votingData.updateBalance(\n        params.from,\n        voteFrom,\n        params.balanceFrom,\n        params.balanceFrom.sub(params.amount),\n        params.newTotalSupply,\n        defaultValue,\n        emitEvent\n    );\n}\n\nif (params.to!= address(0)) {\n    votingData.updateBalance(\n        params.to,\n        voteTo,\n        params.balanceTo,\n        params.balanceTo.add(params.amount),\n        params.newTotalSupply,\n        defaultValue,\n        emitEvent\n    );\n}\n```
MEDIUM severity: The `VoteKickPolicy.onFlag()` function contains a vulnerability where the calculation of `targetStak. The `VoteKickPolicy.onFlag()` function contains a vulnerability where the calculation of `targetStakeAtRiskWei[target]` may result in an unexpected value that exceeds `stakedWei[target]`. This can occur when the `streamrConfig.minimumStakeWei()` value is increased after an operator has initially sta...

Vulnerable code:
```\ntargetStakeAtRiskWei[target] = max(stakedWei[target], \n    streamrConfig.minimumStakeWei()) * \n    streamrConfig.slashingFraction() / 1 ether\n```
MEDIUM severity: The `SellUSSDBuyCollateral` function in the `USSDRebalancer` contract is vulnerable to an out-of-bou. The `SellUSSDBuyCollateral` function in the `USSDRebalancer` contract is vulnerable to an out-of-bounds array access issue when the collateral factor is greater than all the elements in the `flutterRatios` array. This occurs when the loop iterates through the array and the `flutter` variable is set...

Vulnerable code:
```\nuint256 cf = IUSSD(USSD).collateralFactor();\nuint256 flutter = 0;\n\nfor (flutter = 0; flutter < flutterRatios.length; flutter++) {\n    if (cf < flutterRatios[flutter]) {\n        break;\n    }\n}\n```\n```\nif (collateralval * 1e18 / ownval < collateral[i].ratios[flutter]):\n    portions++\n```\n```\nif (collateralval * 1e18 / ownval < collateral[i].ratios[flutter]):\n    if (collateral[i].token!= uniPool.token0() or collateral[i].token!= uniPool.token1()):\n        IUSSD(USSD).UniV3SwapInput(collateral[i].pathbuy, daibought/portions)\n```
MEDIUM severity: This vulnerability allows malicious PartyB to block unfavorable close position requests by intention. This vulnerability allows malicious PartyB to block unfavorable close position requests by intentionally prolonging the force close position cooldown period, thereby causing a loss of profits for PartyA. When PartyA attempts to close a quote, the quote's status transitions to `QuoteStatus.CLOSE_PEND...

Vulnerable code:
```\nFile: PartyAFacetImpl.sol\n\nfunction forceClosePosition(uint256 quoteId, PairUpnlAndPriceSig memory upnlSig) internal {\n    AccountStorage.Layout storage accountLayout = AccountStorage.layout();\n    MAStorage.Layout storage maLayout = MAStorage.layout();\n    Quote storage quote = QuoteStorage.layout().quotes[quoteId];\n\n    uint256 filledAmount = quote.quantityToClose;\n    require(quote.quoteStatus == QuoteStatus.CLOSE_PENDING, "PartyAFacet: Invalid state");\n    require(\n        block.timestamp > quote.modifyTimestamp + maLayout.forceCloseCooldown,\n        "PartyAFacet: Cooldown not reached"\n    );\n```\n```\nFile: PartyBFacetImpl.sol\n\nfunction fillCloseRequest(\n    uint256 quoteId,\n    uint256 filledAmount,\n    uint256 closedPrice,\n    PairUpnlAndPriceSig memory upnlSig\n) internal {\n    if (quote.orderType == OrderType.LIMIT) {\n        require(quote.quantityToClose >= filledAmount, "PartyBFacet: Invalid filledAmount");\n    } else {\n        require(quote.quantityToClose == filledAmount, "PartyBFacet: Invalid filledAmount");\n    }\n    LibQuote.closeQuote(quote, filledAmount, closedPrice);\n}\n```\n```\nfunction closeQuote(Quote storage quote, uint256 filledAmount, uint256 closedPrice) internal {\n    QuoteStorage.Layout storage quoteLayout = QuoteStorage.layout();\n    AccountStorage.Layout storage accountLayout = AccountStorage.layout();\n\n    quote.modifyTimestamp = block.timestamp;\n    //...SNIP...\n```
MEDIUM severity: The vulnerability arises when a user is unable to partially repay their loan by posting insufficient. The vulnerability arises when a user is unable to partially repay their loan by posting insufficient ISOUSD to bring their margin back above the minimum opening margin. This limitation is enforced by the `closeLoan` function, which checks if the remaining debt after repayment meets the minimum margi...

Vulnerable code:
```\nif (outstandingisoUSD >= TENTH_OF_CENT) { // ignore leftover debts less than $0.001\n    uint256 collateralLeft = collateralPosted[_collateralAddress][msg.sender] - _collateralToUser;\n    uint256 colInUSD = priceCollateralToUSD(currencyKey, collateralLeft);\n    uint256 borrowMargin = (outstandingisoUSD * minOpeningMargin) / LOAN_SCALE;\n    require(colInUSD > borrowMargin, "Remaining debt fails to meet minimum margin!");\n```
MEDIUM severity: The Geode team introduced a mechanism to prevent node operators from proposing an excessive number o. The Geode team introduced a mechanism to prevent node operators from proposing an excessive number of validators, known as the `MONOPOLY_THRESHOLD`. This threshold is checked during the `proposeStake` call, which is initiated by the node operator to propose new validators. The onboarding process inv...

Vulnerable code:
```\nrequire(\n  (DATASTORE.readUintForId(operatorId, "totalActiveValidators") +\n  pubkeys.length) <=\n  self.TELESCOPE.MONOPOLY_THRESHOLD,\n  "StakeUtils: IceBear does NOT like monopolies"\n);\n```
MEDIUM severity: The `updateController` function in the `Tap` contract allows updating the `Controller` contract it i. The `updateController` function in the `Tap` contract allows updating the `Controller` contract it is using. This functionality is currently not restricted in the `FundraisingMultisigTemplate`, which may lead to unintended consequences in custom deployments. The `updateController` function is access...

Vulnerable code:
```\n/**\n * @notice Update controller to `_controller`\n * @param _controller The address of the new controller contract\n*/\nfunction updateController(IAragonFundraisingController _controller) external auth(UPDATE_CONTROLLER_ROLE) {\n    require(isContract(_controller), ERROR_CONTRACT_IS_EOA);\n\n    _updateController(_controller);\n}\n```
MEDIUM severity: The vulnerability allows attackers to exploit the flexibility in oracle block ranges to gain insight. The vulnerability allows attackers to exploit the flexibility in oracle block ranges to gain insight into future prices, effectively allowing them to make informed decisions about their trading strategies. This is achieved by canceling limit swap orders submitted in a block range, which can be execu...

Vulnerable code:
```\n1 2 3 4 5 6 7 8 9 <block number>\n\nO1: \n    A B B B C C C D\n    A A B B B C C C\n^^ grouped oracle block ranges\n```
MEDIUM severity: The CollateralizationOracle vulnerability is a misleading comment issue that affects the `isOvercoll. The CollateralizationOracle vulnerability is a misleading comment issue that affects the `isOvercollateralized` function and the `pcvStats` function in the protocol's smart contract. The `isOvercollateralized` function is designed to determine whether the protocol's controlled value (PCV) is greater...

Vulnerable code:
```\nfunction isOvercollateralized() external override view whenNotPaused returns (bool) {\n    (, int256 _protocolEquity, bool _valid) = pcvStats();\n    require(_valid, "CollateralizationOracle: reading is invalid");\n    return _protocolEquity > 0;\n}\n```\n```\n/// @return protocolEquity\n/// the difference between PCV and user circulating FEI\n/// If there are more circulating FEI than $ in the PCV, equity is 0.\n```\n```\nprotocolEquity = int256(protocolControlledValue) - int256(userCirculatingFei)\n```
MEDIUM severity: The `StrategyPassiveManagerUniswap` contract, despite having permissioned roles, is vulnerable to a . The `StrategyPassiveManagerUniswap` contract, despite having permissioned roles, is vulnerable to a rug-pull attack by its owner. This attack exploits the `_onlyCalmPeriods` check by manipulating key parameters, allowing the owner to manipulate the pool's slot0 value and subsequently, the shares cal...

Vulnerable code:
```\nshares = _amount1 + (_amount0 * price / PRECISION)\n```
MEDIUM severity: The vulnerability lies in the fact that the implementation contracts for proxy contracts are not pro. The vulnerability lies in the fact that the implementation contracts for proxy contracts are not properly protected against unauthorized initialization. This can occur when the `initialize` function is not secured, allowing third-party actors to initialize the implementation contract. This is partic...

Vulnerable code:
```\nfunction initialize(\n    address registryAddress\n) public {\n    require(!initialized(), "Contract is already initialized.");\n    _initialized["BondedECDSAKeepVendorImplV1"] = true;\n    registry = Registry(registryAddress);\n}\n```\n```\nfunction initialize(\n    uint256 priceFeedEstimate,\n    uint256 fluctuationMargin,\n    uint256 dkgContributionMargin,\n    uint256 withdrawalDelay,\n    address registry\n) \npublic \n{\n    require(!initialized(), "Contract is already initialized.");\n    _initialized["KeepRandomBeaconServiceImplV1"] = true;\n    _priceFeedEstimate = priceFeedEstimate;\n    _fluctuationMargin = fluctuationMargin;\n    _dkgContributionMargin = dkgContributionMargin;\n    _withdrawalDelay = withdrawalDelay;\n    _pendingWithdrawal = 0;\n    _previousEntry = _beaconSeed;\n    _registry = registry;\n    _baseCallbackGas = 18845;\n}\n```\n```\ncontract DepositFactoryAuthority {\n\n    bool internal _initialized = false;\n    address internal _depositFactory;\n\n    function initialize(address _factory) public {\n        require(! _initialized, "Factory can only be initialized once.");\n        _depositFactory = _factory;\n        _initialized = true;\n    }\n}\n```
MEDIUM severity: The `GovPool::delegateTreasury` function is responsible for transferring ERC20 tokens and specific N. The `GovPool::delegateTreasury` function is responsible for transferring ERC20 tokens and specific NFTs from the DAO treasury to the `govUserKeeper` contract. This function increases the `tokenBalance` and `nftBalance` of the delegatee, allowing them to utilize this delegated voting power to vote on...

Vulnerable code:
```\nfunction delegateTreasury(\n    address delegatee,\n    uint256 amount,\n    uint256[] calldata nftIds\n) external override onlyThis {\n    require(amount > 0 || nftIds.length > 0, "Gov: empty delegation");\n    require(getExpertStatus(delegatee), "Gov: delegatee is not an expert");\n\n    _unlock(delegatee);\n\n    if (amount!= 0) {\n        address token = _govUserKeeper.tokenAddress();\n\n        IERC20(token).transfer(address(_govUserKeeper), amount * (10**token.decimals()));\n\n        _govUserKeeper.delegateTokensTreasury(delegatee, amount);\n    }\n\n    if (nftIds.length!= 0) {\n        IERC721 nft = IERC721(_govUserKeeper.nftAddress());\n\n        for (uint256 i = 0; i < nftIds.length; i++) {\n            nft.safeTransferFrom(address(this), address(_govUserKeeper), nftIds[i]);\n        }\n\n        _govUserKeeper.delegateNftsTreasury(delegatee, nftIds);\n    }\n\n    _revoteDelegated(delegatee, VoteType.TreasuryVote);\n\n    emit DelegatedTreasury(delegatee, amount, nftIds, true);\n}\n```
MEDIUM severity: The `jumpStartAccount` function in the `InfinityPool` contract allows an account to be initialized w. The `jumpStartAccount` function in the `InfinityPool` contract allows an account to be initialized with a debt position in the pool, bypassing the standard approval checks typically applied to regular borrowing. This function is accessible only to the contract's owner and enables the creation of an...

Vulnerable code:
```\nfunction jumpStartAccount(address receiver, uint256 agentID, uint256 accountPrincipal) external onlyOwner {\n    Account memory account = _getAccount(agentID);\n\n    if (account.principal!= 0) {\n        revert InvalidState();\n    }\n\n    account.principal = accountPrincipal;\n    account.startEpoch = block.number;\n    account.epochsPaid = block.number;\n\n    account.save(router, agentID, id);\n\n    GetRoute.agentPolice(router).addPoolToList(agentID, id);\n\n    liquidStakingToken.mint(receiver, convertToShares(accountPrincipal));\n\n    totalBorrowed += accountPrincipal;\n}\n```
MEDIUM severity: The vulnerability allows an attacker to exploit the lock update logic on secondary chains to increas. The vulnerability allows an attacker to exploit the lock update logic on secondary chains to increase the amount of rewards sent to a specific secondary chain. This is achieved by manipulating the `queuedRESDLSupplyChange` variable, which is used to calculate the rewards distributed to each secondar...

Vulnerable code:
```\nfunction _queueLockUpdate(\n    address _owner,\n    uint256 _lockId,\n    uint256 _amount,\n    uint64 _lockingDuration\n) internal onlyLockOwner(_lockId, _owner) {\n    Lock memory lock = _getQueuedLockState(_lockId);\n    LockUpdate memory lockUpdate = LockUpdate(updateBatchIndex, _updateLock(lock, _amount, _lockingDuration));\n    queuedLockUpdates[_lockId].push(lockUpdate);\n    queuedRESDLSupplyChange += \n        int256(lockUpdate.lock.amount + lockUpdate.lock.boostAmount) - \n        int256(lock.amount + lock.boostAmount);\n}\n```\n```\nfunction _updateLock(\n    Lock memory _lock,\n    uint256 _amount,\n    uint64 _lockingDuration\n) internal view returns (Lock memory) {\n    if ((_lock.expiry == 0 || _lock.expiry > block.timestamp) && _lockingDuration < _lock.duration) {\n        revert InvalidLockingDuration();\n    }\n\n    Lock memory lock = Lock(\n        _lock.amount,\n        _lock.boostAmount,\n        _lock.startTime,\n        _lock.duration,\n        _lock.expiry\n    );\n\n    uint256 baseAmount = _lock.amount + _amount;\n    uint256 boostAmount = boostController.getBoostAmount(baseAmount, _lockingDuration);\n\n    lock.boostAmount = boostAmount;\n}\n```\n```\nuint256 numUpdates = queuedLockUpdates[lockId].length;\n\nLock memory curLockState = locks[lockId];\nuint256 j = 0;\nwhile (j < numUpdates) {\n    if (queuedLockUpdates[lockId][j].updateBatchIndex > finalizedBatchIndex) {\n        break;\n    }\n\n    Lock memory updateLockState = queuedLockUpdates[lockId][j].lock;\n    int256 baseAmountDiff = int256(updateLockState.amount) - int256(curLockState.amount);\n    int256 boostAmountDiff = int256(updateLockState.boostAmount) - int256(curLockState.boostAmount);\n\n    if (baseAmountDiff < 0) {\n        // rest of code\n    } else if (boostAmountDiff < 0) {\n        locks[lockId].expiry = updateLockState.expiry;\n        locks[lockId].boostAmount = 0;\n        emit InitiateUnlock(_owner, lockId, updateLockState.expiry);\n    } else {\n        // rest of code\n    }\n}\n// rest of code\n```\n```\nqueuedRESDLSupplyChange += \n    int256(lockUpdate.lock.amount + lockUpdate.lock.boostAmount) - \n    int256(lock.amount + lock.boostAmount);\n```
MEDIUM severity: The Reactivated Gauges Can't Queue Up Rewards vulnerability occurs when a gauge is deactivated and t. The Reactivated Gauges Can't Queue Up Rewards vulnerability occurs when a gauge is deactivated and then reactivated, causing issues with the queuing of rewards. This vulnerability arises from the way the `ERC20Gauges` contract handles gauge activation and deactivation.\n\nWhen a gauge is initially a...

Vulnerable code:
```\ngaugeQueuedRewards[gauge] = QueuedRewards({\n    priorCycleRewards: queuedRewards.priorCycleRewards + completedRewards,\n    cycleRewards: uint112(nextRewards),\n    storedCycle: currentCycle\n});\n```\n```\nassert(queuedRewards.storedCycle == 0 or queuedRewards.storedCycle >= lastCycle)\n```
MEDIUM severity: The `mintOpenInterestDebt()` function in the Penrose contract is responsible for tracking and distri. The `mintOpenInterestDebt()` function in the Penrose contract is responsible for tracking and distributing rewards to twTap holders based on the current USDO open interest. However, the function has two critical issues that can lead to the loss of twTap rewards.\n\nFirstly, the function does not acc...

Vulnerable code:
```\nfunction mintOpenInterestDebt(address twTap) external onlyOwner {\n    uint256 usdoSupply = usdoToken.totalSupply();\n\n    // nothing to mint when there's no activity\n    if (usdoSupply > 0) {\n        // re-compute latest debt\n        uint256 totalUsdoDebt = computeTotalDebt();\n\n        // add Origins debt\n        uint256 len = allOriginsMarkets.length;\n        for (uint256 i = 0; i < len; i++) {\n            IMarket market = IMarket(allOriginsMarkets[i]);\n            if (isOriginRegistered[address(market)]) {\n                (uint256 elastic,) = market.totalBorrow();\n                totalUsdoDebt += elastic;\n            }\n        }\n\n        // debt should always be > USDO supply\n        if (totalUsdoDebt > usdoSupply) {\n            uint256 _amount = totalUsdoDebt - usdoSupply;\n\n            // mint against the open interest; supply should be fully minted now\n            IUsdo(address(usdoToken)).mint(address(this), _amount);\n\n            // send it to twTap\n            uint256 rewardTokenId = ITwTap(twTap).rewardTokenIndex(address(usdoToken));\n            _distributeOnTwTap(_amount, rewardTokenId, address(usdoToken), ITwTap(twTap));\n        }\n    }\n}\n```