Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: This vulnerability allows an attacker to drain protocol funds by exploiting the consecutive symbol p. This vulnerability allows an attacker to drain protocol funds by exploiting the consecutive symbol price updates in the liquidation process. The `setSymbolsPrice` function in the `LiquidationFacetImpl` library is used to update the prices of symbols for a party's positions. The function is called by...

Vulnerable code:
```\ngit apply exploit-liquidation.patch\nnpx hardhat test\n```
MEDIUM severity: The `PriceOracle.getPrice` function retrieves the latest price data from the Chainlink registry, but. The `PriceOracle.getPrice` function retrieves the latest price data from the Chainlink registry, but it does not verify the freshness of the data. This means that the function may return stale prices, which can lead to incorrect decisions being made by the protocol. As a result, the protocol may inc...

Vulnerable code:
```\nfunction getPriceFromChainlink(address base, address quote) internal view returns (uint256) {\n    (, int256 price,,,,) = registry.latestRoundData(base, quote);\n    require(price > 0, "invalid price");\n\n    // Extend the decimals to 1e18.\n    return uint256(price) * 10 ** (18 - uint256(registry.decimals(base, quote)));\n}\n```
MEDIUM severity: The vulnerability occurs when a bridge token B is already deployed and the `confirmDeployment` funct. The vulnerability occurs when a bridge token B is already deployed and the `confirmDeployment` function is called on the other layer, setting the `nativeToBridgedToken` value of the native token A to `DEPLOYED_STATUS`. This scenario prevents the bridge token B from bridging to the native token A in...

Vulnerable code:
```\nif (nativeMappingValue == NATIVE_STATUS) {\n    IERC20(_nativeToken).safeTransfer(_recipient, _amount);\n} else {\n    bridgedToken = nativeMappingValue;\n    if (nativeMappingValue == EMPTY) {\n        bridgedToken = deployBridgedToken(_nativeToken, _tokenMetadata);\n        bridgedToNativeToken[bridgedToken] = _nativeToken;\n        nativeToBridgedToken[_nativeToken] = bridgedToken;\n    }\n    BridgedToken(bridgedToken).mint(_recipient, _amount);\n}\n```\n```\nfunction setDeployed(address[] memory _nativeTokens) external onlyMessagingService fromRemoteTokenBridge {\n    address nativeToken;\n    for (uint256 i; i < _nativeTokens.length; i++) {\n        nativeToken = _nativeTokens[i];\n        nativeToBridgedToken[_nativeTokens[i]] = DEPLOYED_STATUS;\n        emit TokenDeployed(_nativeTokens[i]);\n    }\n}\n```
MEDIUM severity: This vulnerability occurs when a contract, such as the `StakingContract`, fails to inherit from the . This vulnerability occurs when a contract, such as the `StakingContract`, fails to inherit from the interface declarations that it implements. In this case, the `StakingContract` contract claims to implement the `IStakingContractFeeDetails` interface, but does not explicitly inherit from it. This ca...

Vulnerable code:
```\ncontract StakingContract {\n    using StakingContractStorageLib for bytes32;\n\n    // @title Ethereum Staking Contract\n    // @author Kiln\n    // @notice You can use this contract to store validator keys and have users fund them and trigger deposits.\n}\n```\n```\ninterface IStakingContractFeeDetails {\n    function getWithdrawerFromPublicKeyRoot(bytes32 _publicKeyRoot) external view returns (address);\n\n    function getTreasury() external view returns (address);\n\n    function getOperatorFeeRecipient(bytes32 pubKeyRoot) external view returns (address);\n\n    function getGlobalFee() external view returns (uint256);\n\n    function getOperatorFee() external view returns (uint256);\n\n    function getExitRequestedFromRoot(bytes32 _publicKeyRoot) external view returns (bool);\n\n    function getWithdrawnFromPublicKeyRoot(bytes32 _publicKeyRoot) external view returns (bool);\n\n    function toggleWithdrawnFromPublicKeyRoot(bytes32 _publicKeyRoot) external;\n}\n```\n```\ninterface IFeeRecipient {\n    function init(address _dispatcher, bytes32 _publicKeyRoot) external;\n\n    function withdraw() external;\n}\n```
MEDIUM severity: The `GovLocks` contract's use of a `deposits` mapping to track user deposits can lead to an unexpect. The `GovLocks` contract's use of a `deposits` mapping to track user deposits can lead to an unexpected issue. When users transfer `govLocks` freely, they may end up with a discrepancy between their `deposits` balance and their actual `govLocks` balance. This can cause issues when attempting to withd...

Vulnerable code:
```\nfunction deposit(uint256 amount) external {\n    deposits[msg.sender] += amount;\n    _moveDelegates(address(0), delegates[msg.sender], amount);\n    SafeTransferLib.safeTransferFrom(locks, msg.sender, address(this), amount);\n    _mint(msg.sender, amount);\n}\n\n/// @notice Withdraws Locks to burn Govlocks\n/// @param amount Amount of Locks to withdraw\nfunction withdraw(uint256 amount) external {\n    deposits[msg.sender] -= amount;\n    _moveDelegates(delegates[msg.sender], address(0), amount);\n    _burn(msg.sender, amount);\n    SafeTransferLib.safeTransfer(locks, msg.sender, amount);\n}\n```
MEDIUM severity: The vulnerability in the `lockCapital()` function of the Goldfinch protocol's `ProtectionPool` contr. The vulnerability in the `lockCapital()` function of the Goldfinch protocol's `ProtectionPool` contract allows for a malicious seller to force the failure of the `lockCapital()` function, resulting in the loss of compensation for the buyer. This occurs when the status of the lending pool changes fro...

Vulnerable code:
```\nfunction lockCapital(address _lendingPoolAddress)\n    external\n    payable\n    override\n    onlyDefaultStateManager\n    whenNotPaused\n    returns (uint256 _lockedAmount, uint256 _snapshotId)\n{\n    uint256 _length = activeProtectionIndexes.length();\n    for (uint256 i = 0; i < _length; i++) {\n        uint256 _remainingPrincipal = poolInfo.referenceLendingPools.calculateRemainingPrincipal(\n            _lendingPoolAddress,\n            protectionInfo.buyer,\n            protectionInfo.purchaseParams.nftLpTokenId\n        );\n    }\n```\n```\nfunction calculateRemainingPrincipal(\n    address _lendingPoolAddress,\n    address _lender,\n    uint256 _nftLpTokenId\n) public view override returns (uint256 _principalRemaining) {\n    if (_poolTokens.ownerOf(_nftLpTokenId) == _lender) {\n        IPoolTokens.TokenInfo memory _tokenInfo = _poolTokens.getTokenInfo(_nftLpTokenId);\n\n        if (\n            _tokenInfo.pool == _lendingPoolAddress &&\n            _isJuniorTrancheId(_tokenInfo.tranche)\n        ) {\n            _principalRemaining = _tokenInfo.principalAmount - _tokenInfo.principalRedeemed;\n        }\n    }\n}\n```\n```\ncontract PoolTokens is IPoolTokens, ERC721PresetMinterPauserAutoIdUpgradeSafe, HasAdmin, IERC2981 {\n  function burn(uint256 tokenId) external virtual override whenNotPaused {\n    TokenInfo memory token = _getTokenInfo(tokenId);\n    bool canBurn = _isApprovedOrOwner(_msgSender(), tokenId);\n    bool fromTokenPool = _validPool(_msgSender()) && token.pool == _msgSender();\n    address owner = ownerOf(tokenId);\n    require(canBurn || fromTokenPool, "ERC721Burnable: caller cannot burn this token");\n    require(token.principalRedeemed == token.principalAmount, "Can only burn fully redeemed tokens");\n    _destroyAndBurn(tokenId);\n    emit TokenBurned(owner, token.pool, tokenId);\n  }\n```\n```\ncontract ERC721UpgradeSafe is\n    Initializable,\n    ContextUpgradeSafe,\n    ERC165UpgradeSafe,\n    IERC721,\n    IERC721Metadata,\n    IERC721Enumerable\n{\n    function ownerOf(uint256 tokenId) public view override returns (address) {\n        return _tokenOwners.get(tokenId, "ERC721: owner query for nonexistent token");\n    }\n}\n```
MEDIUM severity: The `baseOracleCircuitBreaker()` function in the `LibOracle` library uses a hardcoded value of 50% p. The `baseOracleCircuitBreaker()` function in the `LibOracle` library uses a hardcoded value of 50% price deviation (0.5 ether) to determine whether the reported price from Chainlink is valid or not. This hardcoded value is used to calculate the price deviation between the reported price and the prot...

Vulnerable code:
```\nfunction baseOracleCircuitBreaker(\n    uint256 protocolPrice,\n    uint80 roundId,\n    int256 chainlinkPrice,\n    uint256 timeStamp,\n    uint256 chainlinkPriceInEth\n) private view returns (uint256 _protocolPrice) {\n    bool invalidFetchData = roundId == 0 || timeStamp == 0\n        || timeStamp > block.timestamp || chainlinkPrice <= 0\n        || block.timestamp > 2 hours + timeStamp;\n    uint256 chainlinkDiff = chainlinkPriceInEth > protocolPrice\n       ? chainlinkPriceInEth - protocolPrice\n        : protocolPrice - chainlinkPriceInEth;\n    bool priceDeviation = protocolPrice > 0 && chainlinkDiff.div(protocolPrice) > 0.5 ether;\n\n    if (invalidFetchData || priceDeviation) {\n        // rest of code\n    } else {\n        return chainlinkPriceInEth;\n    }\n}\n```
MEDIUM severity: This vulnerability allows an attacker to manipulate the `lastRepay` variable, which tracks the last . This vulnerability allows an attacker to manipulate the `lastRepay` variable, which tracks the last repayment block for a borrower, to write off a loan before the overdue delay expires. This can occur when a borrower takes a second loan after a loan has been written off, and the `lastRepay` variable...

Vulnerable code:
```\nif (block.number <= lastRepay + overdueBlocks + maxOverdueBlocks) {\n    if (staker!= msg.sender) {\n        revert AuthFailed();\n    }\n}\n```
MEDIUM severity: The protocol's upgrade mechanism for agents lacks built-in re-entrancy protection, which can lead to. The protocol's upgrade mechanism for agents lacks built-in re-entrancy protection, which can lead to potential security vulnerabilities. Although the `wFIL` token and careful use of `FIL` transfers are designed to prevent re-entrancy, there are still areas in the code where issues may arise.\n\nOne...

Vulnerable code:
```\nfunction upgradeAgent(\n    address agent\n) external returns (address newAgent) {\n    IAgent oldAgent = IAgent(agent);\n    address owner = IAuth(address(oldAgent)).owner();\n    uint256 agentId = agents[agent];\n\n    // only the Agent's owner can upgrade, and only a registered agent can be upgraded\n    if (owner!= msg.sender || agentId == 0) {\n        revert Unauthorized();\n    }\n\n    // deploy a new instance of Agent with the same ID and auth\n    newAgent = GetRoute.agentDeployer(router).deploy(\n        router,\n        agentId,\n        owner,\n        IAuth(address(oldAgent)).operator()\n    );\n\n    // Register the new agent and unregister the old agent\n    agents[newAgent] = agentId;\n\n    // transfer funds from old agent to new agent and mark old agent as decommissioning\n    oldAgent.decommissionAgent(newAgent);\n\n    // delete the old agent from the registry\n    agents[agent] = 0;\n}\n```\n```\nfunction decommissionAgent(address _newAgent) external {\n    // only the agent factory can decommission an agent\n    AuthController.onlyAgentFactory(router, msg.sender);\n\n    // if the newAgent has a mismatching ID, revert\n    if (IAgent(_newAgent).id()!= id) {\n        revert Unauthorized();\n    }\n\n    // set the newAgent in storage, which marks the upgrade process as starting\n    newAgent = _newAgent;\n\n    uint256 _liquidAssets = liquidAssets();\n\n    // Withdraw all liquid funds from the Agent to the newAgent\n    _poolFundsInFIL(_liquidAssets);\n\n    // transfer funds to new agent\n    payable(_newAgent).sendValue(_liquidAssets);\n}\n```
MEDIUM severity: The `PrivateOffer` contract's `initialize()` function is responsible for setting up a customized dea. The `PrivateOffer` contract's `initialize()` function is responsible for setting up a customized deal for a specific investor. This function accepts several parameters to configure the `PrivateOffer`, including `tokenAmount`, `token`, and `currency`. However, upon examination, it becomes apparent th...

Vulnerable code:
```\nuint256 currencyAmount = Math.ceilDiv(\n    _arguments.tokenAmount * _arguments.tokenPrice,\n    10 ** _arguments.token.decimals()\n);\n```
MEDIUM severity: The vulnerability is related to the calculation of gas supplied to static calls, which is calculated. The vulnerability is related to the calculation of gas supplied to static calls, which is calculated by subtracting 2000 from the remaining gas at a specific point in time. If not enough gas is provided, the static calls may fail, leading to unpredictable outcomes. This can result in the execution o...

Vulnerable code:
```\npop(staticcall(sub(gas(), 2000), 0x2, \n                add(mPtr, 0x1b), size, mPtr, 0x20))\n```\n```\npop(staticcall(sub(gas(), 2000),\n              0x2,\n              add(mPtr, 0x1c),\n              0x24,\n              mPtr,\n              0x20))\n```\n```\npop(staticcall(sub(gas(), 2000), 0x2, \n                add(mPtr, 0x1b), 0x65, \n                mPtr, 0x20))\n```\n```\npop(staticcall(sub(gas(), 2000), 0x2, \n                add(mPtr, 0x1c), 0xe4, \n                mPtr, 0x20))\n```\n```\npop(staticcall(sub(gas(), 2000),\n              0x2,\n              add(mPtr, start_input),\n              size_input,\n              add(state, state_gamma_kzg),\n              0x20))\n```\n```\npop(staticcall(sub(gas(), 2000), 0x05, mPtr, 0xc0, 0x00, 0x20))\n```\n```\npop(staticcall(sub(gas(), 2000), 0x05, mPtr, 0xc0, mPtr, 0x20))\n```\n```\npop(staticcall(sub(gas(), 2000), 0x05, mPtr, 0xc0, mPtr, 0x20))\n```\n```\npop(staticcall(sub(gas(), 2000), 7, folded_evals_commit, 0x60, folded_evals_commit, 0x40))\n```\n```\nlet l_success := \n    staticcall(\n        sub(gas(), 2000),\n        6,\n        mPtr,\n        0x80,\n        dst,\n        0x40\n    )\n```\n```\nlet l_success := \n    staticcall(\n        sub(gas(), 2000),\n        7,\n        mPtr,\n        0x60,\n        dst,\n        0x40\n    )\n```\n```\nlet l_success := \n    staticcall(\n        sub(gas(), 2000),\n        7,\n        mPtr,\n        0x60,\n        mPtr,\n        0x40\n    )\n```\n```\nl_success := \n    and(\n        l_success, \n        staticcall(\n            sub(gas(), 2000), \n            6, \n            mPtr, \n            0x80, \n            dst, \n            0x40\n        )\n    )\n```
MEDIUM severity: The `LibWell::getWellPriceFromTwaReserves` function calculates the price of a well based on the time. The `LibWell::getWellPriceFromTwaReserves` function calculates the price of a well based on the time-weighted average reserves of the zeroth and first reserves. However, the function does not properly handle the scenario where one of the reserves is zero. Specifically, if the `twaReserves` array con...

Vulnerable code:
```\nfunction getWellPriceFromTwaReserves(address well) internal view returns (uint256 price) {\n    AppStorage storage s = LibAppStorage.diamondStorage();\n\n    if (s.twaReserves[well].reserve0 == 0) {\n        price = 0;\n    } else {\n        price = s.twaReserves[well].reserve0.mul(1e18).div(s.twaReserves[well].reserve1);\n    }\n}\n```\n```\nfunction setTwaReservesForWell(address well, uint256[] memory twaReserves) internal {\n    AppStorage storage s = LibAppStorage.diamondStorage();\n\n    if (twaReserves.length < 1) {\n        delete s.twaReserves[well].reserve0;\n        delete s.twaReserves[well].reserve1;\n    } else {\n        s.twaReserves[well].reserve0 = uint128(twaReserves[0]);\n        s.twaReserves[well].reserve1 = uint128(twaReserves[1]);\n    }\n}\n```
MEDIUM severity: The `finalizeCompressedBlocksWithProof` function in the data finalization process is vulnerable to a. The `finalizeCompressedBlocksWithProof` function in the data finalization process is vulnerable to an incorrect final block number being finalized. This occurs when the `finalBlockNumber` variable, which is obtained from the `finalizationData` object, is not properly validated before being used to d...

Vulnerable code:
```\ncurrentL2BlockNumber = _finalizationData.finalBlockNumber\n```\n```\nif (stateRootHashes[currentL2BlockNumber]!= _finalizationData.parentStateRootHash):\n    revert StartingRootHashDoesNotMatch()\n```
MEDIUM severity: The `wpkhSpendSighash` function in the `CheckBitcoinSigs` contract is responsible for calculating th. The `wpkhSpendSighash` function in the `CheckBitcoinSigs` contract is responsible for calculating the sighash of a Bitcoin transaction. This function accepts several parameters, including `_outpoint`, which is a 36-byte UTXO id consisting of a 32-byte transaction hash and a 4-byte output index. Howe...

Vulnerable code:
```\nfunction wpkhSpendSighash(\n    bytes memory _outpoint,  // 36 byte UTXO id\n    bytes20 _inputPKH,       // 20 byte hash160\n    bytes8 _inputValue,      // 8-byte LE\n    bytes8 _outputValue,     // 8-byte LE\n    bytes memory _outputScript    // length-prefixed output script\n) internal pure returns (bytes32) {\n    bytes memory _scriptCode = abi.encodePacked(\n        hex"1976a914",  // length, dup, hash160, pkh_length\n        _inputPKH,\n        hex"88ac"\n    );\n    bytes32 _hashOutputs = abi.encodePacked(_outputValue, _outputScript).hash256();\n    bytes memory _sighashPreimage = abi.encodePacked(\n        hex"01000000",  // version\n        _outpoint.hash256(),\n        hex"8cb9012517c817fead650287d61bdd9c68803b6bf9c64133dcab3e65b5a50cb9",  // hashSequence(00000000)\n        _outpoint,  // outpoint\n        _scriptCode,  // p2wpkh script code\n        _inputValue,  // value of the input in 8-byte LE\n        hex"00000000",  // input nSequence\n        _hashOutputs,  // hash of the single output\n        hex"00000000",  // nLockTime\n        hex"01000000"  // SIGHASH_ALL\n    );\n    return _sighashPreimage.hash256();\n}\n```
MEDIUM severity: The `Delay` app's `pauseExecution` function allows scripts to be paused even after their scheduled e. The `Delay` app's `pauseExecution` function allows scripts to be paused even after their scheduled execution time has elapsed. This capability is intended to temporarily halt the execution of a delayed script, allowing it to resume at a later time. However, this feature can be exploited to indefinit...

Vulnerable code:
```\nfunction _delayExecution(bytes _evmCallScript) internal returns (uint256) {\n    uint256 delayedScriptIndex = delayedScriptsNewIndex;\n    delayedScriptsNewIndex++;\n\n    delayedScripts[delayedScriptIndex] = DelayedScript(getTimestamp64().add(executionDelay), 0, _evmCallScript);\n\n    emit DelayedScriptStored(delayedScriptIndex);\n\n    return delayedScriptIndex;\n}\n```\n```\nfunction pauseExecution(uint256 _delayedScriptId) external auth(PAUSE_EXECUTION_ROLE) {\n    require(!isExecutionPaused(_delayedScriptId), ERROR_CANNOT_PAUSE);\n    delayedScripts[_delayedScriptId].pausedAt = getTimestamp64();\n\n    emit ExecutionPaused(_delayedScriptId);\n}\n```\n```\nfunction resumeExecution(uint256 _delayedScriptId) external auth(RESUME_EXECUTION_ROLE) {\n    require(_isExecutionPaused(_delayedScriptId), ERROR_CANNOT_RESUME);\n    DelayedScript storage delayedScript = delayedScripts[_delayedScriptId];\n\n    uint64 timePaused = getTimestamp64().sub(delayedScript.pausedAt);\n    delayedScript.executionTime = delayedScript.executionTime.add(timePaused);\n    delayedScript.pausedAt = 0;\n\n    emit ExecutionResumed(_delayedScriptId);\n}\n```
MEDIUM severity: The vulnerability arises when leveraging executors, such as `SimpleLeverageExecutor`, fail to consid. The vulnerability arises when leveraging executors, such as `SimpleLeverageExecutor`, fail to consider fees when wrapping mtOFTs. This oversight leads to a Denial of Service (DoS) scenario, where contracts performing wraps believe they have more funds than intended, resulting in a malfunctioning lev...

Vulnerable code:
```\nfunction wrap(address _fromAddress, address _toAddress, uint256 _amount)\n    external\n    payable\n    whenNotPaused\n    nonReentrant\n    returns (uint256 minted)\n{\n    uint256 feeAmount = _checkAndExtractFees(_amount);\n    if (erc20 == address(0)) {\n        _wrapNative(_toAddress, _amount, feeAmount);\n    } else {\n        if (msg.value > 0) revert mTOFT_NotNative();\n        _wrap(_fromAddress, _toAddress, _amount, feeAmount);\n    }\n\n    return _amount - feeAmount;\n}\n```\n```\nfunction _swapAndTransferToSender(\n    bool sendBack,\n    address tokenIn,\n    address tokenOut,\n    uint256 amountIn,\n    bytes memory data\n) internal returns (uint256 amountOut) {\n    SLeverageSwapData memory swapData = abi.decode(data, (SLeverageSwapData));\n\n    // If the tokenOut is a tOFT, wrap it. Handles ETH and ERC20.\n    // If `sendBack` is true, wrap the `amountOut` to the sender. else, wrap it to this contract.\n    if (swapData.toftInfo.isTokenOutToft) {\n        _handleToftWrapToSender(sendBack, tokenOut, amountOut);\n    } else if (sendBack) {\n        // If the token wasn't sent by the wrap OP, send it as a transfer.\n        IERC20(tokenOut).safeTransfer(msg.sender, amountOut);\n    }\n}\n```\n```\nfunction _handleToftWrapToSender(bool sendBack, address tokenOut, uint256 amountOut) internal {\n    address toftErc20 = ITOFT(tokenOut).erc20();\n    address wrapsTo = sendBack == true? msg.sender : address(this);\n\n    if (toftErc20 == address(0)) {\n        weth.withdraw(amountOut);\n        ITOFT(tokenOut).wrap{value: amountOut}(address(this), wrapsTo, amountOut);\n    } else {\n        toftErc20.safeApprove(tokenOut, amountOut);\n        ITOFT(tokenOut).wrap(address(this), wrapsTo, amountOut);\n        toftErc20.safeApprove(tokenOut, 0);\n    }\n}\n```\n```\n// BBLeverage.sol\n\nfunction buyCollateral(\n    address from,\n    uint256 borrowAmount,\n    uint256 supplyAmount,\n    bytes calldata data\n) \n    external\n    optionNotPaused(PauseType.LeverageBuy)\n    solvent(from, false)\n    notSelf(from)\n    returns (uint256 amountOut)\n{\n    amountOut = leverageExecutor.getCollateral(\n        collateralId,\n        address(asset),\n        address(collateral),\n        memoryData.supplyShareToAmount + memoryData.borrowShareToAmount,\n        calldata_.from,\n        calldata_.data\n    );\n    uint256 collateralShare = yieldBox.toShare(collateralId, amountOut, false);\n    address(asset).safeApprove(address(yieldBox), type(uint256).max);\n    yieldBox.depositAsset(collateralId, address(this), address(this), 0, collateralShare);\n    address(asset).safeApprove(address(yieldBox), 0);\n}\n```
MEDIUM severity: The liquidity pool's withdrawal mechanism is vulnerable to an imbalance in the distribution of funds. The liquidity pool's withdrawal mechanism is vulnerable to an imbalance in the distribution of funds among stakeholders. When a stakeholder withdraws their liquidity, the system should ensure that each participant receives an equal share of their staked amount plus a proportionate share of the fees...

Vulnerable code:
```\nIPoolTokensContainer(anchor).burn(_poolToken, msg.sender, _amount);\n\nuint256 reserveAmount = 0;\nif (_amount == initialPoolSupply) {\n    reserveAmount = balance;\n} else {\n    reserveAmount = _amount.mul(balance).div(initialPoolSupply);\n\nreserves[reserveToken].balance = reserves[reserveToken].balance.sub(reserveAmount);\nuint256 newStakedBalance = stakedBalances[reserveToken].sub(reserveAmount);\nstakedBalances[reserveToken] = newStakedBalance;\n```
MEDIUM severity: The `addPremium` function, publicly accessible and intended to distribute weekly premium payments to. The `addPremium` function, publicly accessible and intended to distribute weekly premium payments to pool managers and remaining pool share holders, is vulnerable to a critical issue. When the collateral deposited is insufficient to cover the total coverage offered to insurance holders for a given w...

Vulnerable code:
```\nrefundMap[policyIndex_][week] = \n    incomeMap[policyIndex_][week].mul(\n        allCovered.sub(maximumToCover)\n    ).div(allCovered);\n```