Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: The ChainlinkFactory's `commit` function, which is responsible for committing prices to specified ve. The ChainlinkFactory's `commit` function, which is responsible for committing prices to specified versions, has a critical flaw. The function ignores the `numRequested` parameter, which is intended to determine whether a keeper fee should be paid. Instead, the function pays keeper fees for both requ...

Vulnerable code:
```\nfunction commit(bytes32[] memory ids, uint256 version, bytes calldata data) external payable {\n    /// @notice Commits the price to specified version\n    /// @dev Accepts both requested and non-requested versions.\n    ///      Requested versions will pay out a keeper fee, non-requested versions will not.\n    ///      Accepts any publish time in the underlying price message, as long as it is within the validity window,\n    ///      which means its possible for publish times to be slightly out of order with respect to versions.\n    ///      Batched updates are supported by passing in a list of price feed ids along with a valid batch update data.\n    @param ids The list of price feed ids to commit\n    @param version The oracle version to commit\n    @param data The update data to commit\n```\n```\nfunction _applicableValue(uint256, bytes memory data) internal view override returns (uint256) {\n    bytes[] memory payloads = abi.decode(data, (bytes[]));\n    uint256 totalFeeAmount = 0;\n    for (uint256 i = 0; i < payloads.length; i++) {\n        (, bytes memory report) = abi.decode(payloads[i], (bytes32[3], bytes));\n        (Asset memory fee,,) = feeManager.getFeeAndReward(address(this), report, feeTokenAddress);\n        totalFeeAmount += fee.amount;\n    }\n    return totalFeeAmount;\n}\n```
MEDIUM severity: The vulnerability lies in the implementation of NftPort templates, which fail to properly validate c. The vulnerability lies in the implementation of NftPort templates, which fail to properly validate configuration settings. Specifically, the `royalty` related fields are not thoroughly checked, allowing administrators to set invalid values that can have severe consequences. This is particularly conc...

Vulnerable code:
```\nfunction _validateRuntimeConfig(RuntimeConfig calldata config) internal view {\n    // Can't set royalties to more than 100%\n    require(config.royaltiesBps <= ROYALTIES_BASIS, "Royalties too high");\n\n    // rest of code\n```
MEDIUM severity: The `recipientsCounter` variable in the `DonationVotingMerkleDistributionBaseStrategy` contract is n. The `recipientsCounter` variable in the `DonationVotingMerkleDistributionBaseStrategy` contract is not properly initialized, leading to a vulnerability in the recipient registration process. Specifically, the `recipientToStatusIndexes` mapping is not correctly updated for new recipients, causing the...

Vulnerable code:
```\nfunction _registerRecipient(bytes memory _data, address _sender)\n    internal\n    override\n    onlyActiveRegistration\n    returns (address recipientId)\n{\n    uint8 currentStatus = _getUintRecipientStatus(recipientId);\n\n    if (currentStatus == uint8(Status.None)) {\n        recipientToStatusIndexes[recipientId] = recipientsCounter;\n        _setRecipientStatus(recipientId, uint8(Status.Pending));\n\n        bytes memory extendedData = abi.encode(_data, recipientsCounter);\n        emit Registered(recipientId, extendedData, _sender);\n\n        recipientsCounter++;\n    } else {\n        if (currentStatus == uint8(Status.Accepted)) {\n            _setRecipientStatus(recipientId, uint8(Status.Pending));\n        } else if (currentStatus == uint8(Status.Rejected)) {\n            _setRecipientStatus(recipientId, uint8(Status.Appealed));\n        }\n        emit UpdatedRegistration(recipientId, _data, _sender, _getUintRecipientStatus(recipientId));\n    }\n}\n```\n```\nfunction _getUintRecipientStatus(address _recipientId) internal view returns (uint8 status) {\n    (, uint256 colIndex, uint256 currentRow) = _getStatusRowColumn(_recipientId);\n\n    status = uint8((currentRow << colIndex) & 15);\n\n    return status;\n}\n```\n```\nfunction _getStatusRowColumn(address _recipientId) internal view returns (uint256, uint256, uint256) {\n    uint256 recipientIndex = recipientToStatusIndexes[_recipientId];\n\n    uint256 rowIndex = recipientIndex / 64;\n    uint256 colIndex = (recipientIndex % 64) * 4;\n\n    return (rowIndex, colIndex, statusesBitMap[rowIndex]);\n}\n```\n```\nuint256 public recipientsCounter;\n```\n```\ndef _registerRecipient():\n    recipientToStatusIndexes[Alice] = recipientsCounter = 0\n    _setRecipientStatus(Alice, uint8(Status.Pending))\n    recipientCounter += 1\n```\n```\ndef _getStatusRowColumn():\n    recipientToStatusIndexes[Bob] = 0  # It would access the status of Alice\n\ndef _registerRecipient():\n    currentStatus = _getUintRecipientStatus(recipientId)\n    currentStatus!= uint8(Status.None)  # no new application is recorded in the pool.\n```
MEDIUM severity: The FundingRateArbitrage contract is vulnerable to a draining attack due to a rounding error in the . The FundingRateArbitrage contract is vulnerable to a draining attack due to a rounding error in the `requestWithdraw` function. Specifically, the calculation of `lockedEarnUSDCAmount` involves a decimal division operation that is rounded down, which can lead to an incorrect calculation of the amount...

Vulnerable code:
```\njusdOutside[msg.sender] -= repayJUSDAmount;\nuint256 index = getIndex();\nuint256 lockedEarnUSDCAmount = jusdOutside[msg.sender].decimalDiv(index);\n\nrequire(\n    earnUSDCBalance[msg.sender] >= lockedEarnUSDCAmount,\n    "lockedEarnUSDCAmount is bigger than earnUSDCBalance"\n);\nwithdrawEarnUSDCAmount = earnUSDCBalance[msg.sender] - lockedEarnUSDCAmount;\n```
MEDIUM severity: The `tryToMoveToValidating` function is responsible for transitioning a proposal to the `Validating`. The `tryToMoveToValidating` function is responsible for transitioning a proposal to the `Validating` state when a vote is received and the minimum threshold (`precReq`) is met. This function iterates through each vote option and checks if any of them exceed the `precReq`. If a vote option meets this...

Vulnerable code:
```\ntry_to_move_to_validating(_proposal_id)\n```\n```\nfunction tryToMoveToValidating(uint256 _proposalId) public {\n    Proposal storage _proposal = proposals[_proposalId];\n    require(_proposal.proposalStatus == ProposalStatus.Voting, "VOTING_STATUS_REQUIRED");\n    if (_proposal.currentStatusInitBlock.add(_proposal.votingBlocksDuration) <= block.number) {\n        for (uint256 i = 0; i <= COUNT_CHOICES; i++) {\n            if (_proposal.votes[i] > _proposal.precReq) {\n                internalMoveToValidating(_proposalId);\n            }\n        }\n    }\n}\n```\n```\nfunction internalMoveToValidating(uint256 _proposalId) internal {\n    Proposal storage _proposal = proposals[_proposalId];\n    require(_proposal.proposalStatus == ProposalStatus.Voting, "ONLY_ON_VOTING_STATUS");\n    _proposal.proposalStatus = ProposalStatus.Validating;\n    _proposal.currentStatusInitBlock = block.number;\n    emit StatusChangeToValidating(_proposalId);\n```\n```\nfor (uint256 i = 0; i <= COUNT_CHOICES; i++) {\n    if (_proposal.votes[i] > _proposal.precReq) {\n        internalMoveToValidating(_proposalId);\n    }\n}\n```\n```\nrequire(\n    _proposal.proposalStatus == ProposalStatus.Voting,\n    "ONLY_ON_VOTING_STATUS"\n)\n_proposal.proposalStatus = ProposalStatus.Validating\n```
MEDIUM severity: The `BuyUSSDSellCollateral()` function in the protocol's smart contract is prone to a vulnerability . The `BuyUSSDSellCollateral()` function in the protocol's smart contract is prone to a vulnerability due to a rounding error. This error causes the function to sell an unintended amount of collateral, specifically 0, when attempting to sell a portion of the collateral to maintain the peg of USSD to D...

Vulnerable code:
```\nfunction rebalance() override public {\n    uint256 ownval = getOwnValuation(); // it low enough to dive into if statement (see line below)\n    (uint256 USSDamount, uint256 DAIamount) = getSupplyProportion(); // (3000e6 USSD, 2000e18 DAI)\n    if (ownval < 1e6 - threshold) {\n        // peg-down recovery\n        BuyUSSDSellCollateral((USSDamount - DAIamount / 1e12) / 2); // 500 * 1e6 = (3000e6 - 2000e18 / 1e12) / 2\n```\n```\nfunction BuyUSSDSellCollateral(uint256 amountToBuy) internal {\n    CollateralInfo[] memory collateral = IUSSD(USSD).collateralList();\n\n    uint amountToBuyLeftUSD = amountToBuy * 1e12;\n\n    uint DAItosell = 0;\n\n    for (uint256 i = 0; i < collateral.length; i++) {\n        uint256 collateralval = IERC20Upgradeable(collateral[i].token).balanceOf(USSD) * 1e18 / (10**IERC20MetadataUpgradeable(collateral[i].token).decimals()) * collateral[i].oracle.getPriceUSD() / 1e18;\n\n        if (collateralval > amountToBuyLeftUSD) {\n            if (collateral[i].pathsell.length > 0) {\n                uint256 amountBefore = IERC20Upgradeable(baseAsset).balanceOf(USSD);\n\n                uint256 amountToSellUnits = IERC20Upgradeable(collateral[i].token).balanceOf(USSD) * ((amountToBuyLeftUSD * 1e18 / collateralval) / 1e18) / 1e18;\n\n                IUSSD(USSD).UniV3SwapInput(collateral[i].pathsell, amountToSellUnits);\n\n                amountToBuyLeftUSD -= (IERC20Upgradeable(baseAsset).balanceOf(USSD) - amountBefore);\n\n                DAItosell += (IERC20Upgradeable(baseAsset).balanceOf(USSD) - amountBefore);\n            }\n        }\n    }\n}\n```
MEDIUM severity: The Notional PT redemption mechanism does not utilize the correct function for determining balances,. The Notional PT redemption mechanism does not utilize the correct function for determining balances, which can result in principal losses. Specifically, the `maxRedeem()` function is not accurately calculating the maximum amount of shares that can be transferred from the owner without causing a reve...

Vulnerable code:
```\ndef calculate_max_transferable_shares(\n    owner: str,\n    redeem: Redeem,\n    global_limit: int,\n    user_limit: int\n) -> int:\n    """\n    Calculate the maximum amount of shares that could be transferred from `owner` through `redeem` and not cause a revert,\n    which MUST NOT be higher than the actual maximum that would be accepted (it should underestimate if necessary).\n    MUST factor in both global and user-specific limits, like if redemption is entirely disabled (even temporarily) it MUST return 0.\n    """\n    if redeem.is_disabled():\n        return 0\n    if global_limit < user_limit:\n        return global_limit\n    return user_limit\n```
MEDIUM severity: The `RocketMinipoolStatus` vulnerability arises when changes in the DAO's trusted node members are n. The `RocketMinipoolStatus` vulnerability arises when changes in the DAO's trusted node members are not properly handled, leading to votes getting stuck and preventing the execution of critical functions. This issue is particularly significant in the early stages of the DAO, where the functions respo...

Vulnerable code:
```\nRocketDAONodeTrustedInterface rocketDAONodeTrusted = RocketDAONodeTrustedInterface(getContractAddress("rocketDAONodeTrusted"));\n\nif (calcBase.mul(submissionCount).div(rocketDAONodeTrusted.getMemberCount()) >= rocketDAOProtocolSettingsNetwork.getNodeConsensusThreshold()) {\n    setMinipoolWithdrawable(_minipoolAddress, _stakingStartBalance, _stakingEndBalance);\n}\n```\n```\nRocketDAONodeTrustedInterface rocketDAONodeTrusted = RocketDAONodeTrustedInterface(getContractAddress("rocketDAONodeTrusted"));\n\nif (calcBase.mul(submissionCount).div(rocketDAONodeTrusted.getMemberCount()) >= rocketDAOProtocolSettingsNetwork.getNodeConsensusThreshold()) {\n    updateBalances(_block, _totalEth, _stakingEth, _rethSupply);\n}\n```\n```\nRocketDAONodeTrustedInterface rocketDAONodeTrusted = RocketDAONodeTrustedInterface(getContractAddress("rocketDAONodeTrusted"));\n\nif (calcBase.mul(submissionCount).div(rocketDAONodeTrusted.getMemberCount()) >= rocketDAOProtocolSettingsNetwork.getNodeConsensusThreshold()) {\n    updatePrices(_block, _rplPrice);\n}\n```
MEDIUM severity: The CurveTricryptoOracle contract's `getPrice` function contains a mathematical error that significa. The CurveTricryptoOracle contract's `getPrice` function contains a mathematical error that significantly impacts the calculation of the LP (Liquidity Provider) price. Specifically, the function multiplies the LP price by a factor of 1e18 and then divides the result by the price of ETH (ethPrice). Th...

Vulnerable code:
```\n(lpPrice(\n    virtualPrice,\n    base.getPrice(tokens[1]),\n    ethPrice,\n    base.getPrice(tokens[0])\n) * 1e18) / ethPrice\n```
MEDIUM severity: The "Debt Decay Faster Than Expected" vulnerability arises from a discrepancy between the theoretica. The "Debt Decay Faster Than Expected" vulnerability arises from a discrepancy between the theoretical debt decay rate specified in the whitepaper and its actual implementation in the codebase. According to the whitepaper, the debt decay rate is intended to decay at a rate proportional to the size of...

Vulnerable code:
```\nFile: BondBaseSDA.sol\n\ndefaul:\n    uint256 lastDecayIncrement = debtDecayInterval.mulDiv(payout_, lastTuneDebt);\n    metadata[id_].lastDecay += uint48(lastDecayIncrement);\n```
MEDIUM severity: The vulnerability lies in the implementation of the `_transferERC20` function in the `TransferUtils.. The vulnerability lies in the implementation of the `_transferERC20` function in the `TransferUtils.sol` contract. The function is designed to support the transfer of ERC20 tokens, but it relies on the original transfer functions provided by the token contracts. However, some tokens, such as USDT, d...

Vulnerable code:
```\nTransferUtils.sol\nfunction _transferERC20(address token, address to, uint256 amount) internal {\n    IERC20 erc20 = IERC20(token);\n    require(erc20!= IERC20(address(0)), "Token Address is not an ERC20");\n    uint256 initialBalance = erc20.balanceOf(to);\n    require(erc20.transfer(to, amount), "ERC20 Transfer failed");\n    uint256 balance = erc20.balanceOf(to);\n    require(balance >= (initialBalance + amount), "ERC20 Balance check failed");\n```
MEDIUM severity: The `changeTreasury()` function, responsible for updating the treasury address for a given market, l. The `changeTreasury()` function, responsible for updating the treasury address for a given market, lacks a crucial check to verify whether the new treasury address is different from the existing one. This oversight can lead to unintended consequences, as the function currently cancels the old treasu...

Vulnerable code:
```\nfunction changeTreasury(uint256 _marketId, address _treasury)\n    public\n    onlyTimeLocker\n{\n    if (_treasury == address(0)) {\n        revert AddressZero();\n    }\n\n    address[2] memory vaults = marketIdToVaults[_marketId];\n\n    if (vaults[0] == address(0) || vaults[1] == address(0)) {\n        revert MarketDoesNotExist(_marketId);\n    }\n\n    IVaultV2(vaults[0]).whiteListAddress(_treasury);\n    IVaultV2(vaults[1]).whiteListAddress(_treasury);\n    IVaultV2(vaults[0]).setTreasury(_treasury);\n    IVaultV2(vaults[1]).setTreasury(_treasury);\n\n    emit AddressWhitelisted(_treasury, _marketId);\n}\n```
MEDIUM severity: The codebase employs an architectural pattern where external functions are wrapped around internal f. The codebase employs an architectural pattern where external functions are wrapped around internal functions, which separates concerns and avoids redundancy. This pattern is beneficial in scenarios where multiple external functions reuse the same internal logic. However, this design choice inadverte...

Vulnerable code:
```\nfunction setupVoting(uint256 planId) external nonReentrant returns (address votingVault) {\n    votingVault = _setupVoting(msg.sender, planId);\n}\n```\n```\nfunction _setupVoting(address holder, uint256 planId) internal returns (address) {\n    require(ownerOf(planId) == holder, '!owner');\n}\n```\n```\nfunction segmentPlan(\n    uint256 planId,\n    uint256[] memory segmentAmounts\n) external nonReentrant returns (uint256[] memory newPlanIds) {\n    newPlanIds = new uint256[](segmentAmounts.length);\n    for (uint256 i = 0; i < segmentAmounts.length; i++) {\n        uint256 newPlanId = _segmentPlan(msg.sender, planId, segmentAmounts[i]);\n    }\n}\n```\n```\nfunction _segmentPlan(address holder, uint256 planId, uint256 segmentAmount) internal returns (uint256 newPlanId) {\n    require(ownerOf(planId) == holder, '!owner');\n}\n```\n```\nfunction revokePlans(uint256[] memory planIds) external nonReentrant {\n    for (uint256 i = 0; i < planIds.length; i++) {\n        _revokePlan(msg.sender, planIds[i]);\n    }\n}\n```\n```\nfunction _revokePlan(address vestingAdmin, uint256 planId) internal {\n    Plan memory plan = plans[planId];\n    require(vestingAdmin == plan.vestingAdmin, '!vestingAdmin');\n```
MEDIUM severity: The `BalancerLBPSwapper` contract's `init()` function is vulnerable to front-running attacks during . The `BalancerLBPSwapper` contract's `init()` function is vulnerable to front-running attacks during its deployment process. This occurs when the contract is initialized with a malicious pool address, allowing an attacker to potentially steal tokens owned by the contract. The deployment process invol...

Vulnerable code:
```\nfunction init(IWeightedPool _pool) external {\n    require(address(_pool) == address(0), "BalancerLBPSwapper: initialized");\n\n    pool = _pool;\n    IVault _vault = _pool.getVault();\n\n    vault = _vault;\n\n    require(_pool.getOwner() == address(this), "BalancerLBPSwapper: contract not pool owner");\n```\n```\nIERC20(tokenSpent).approve(address(_vault), type(uint256).max);\nIERC20(tokenReceived).approve(address(_vault), type(uint256).max);\n```
MEDIUM severity: The Exchange contract contains a vulnerability that allows the owner to potentially drain user funds. The Exchange contract contains a vulnerability that allows the owner to potentially drain user funds. This is achieved by manipulating the reentrancy mechanism in the contract's functions, specifically in the `convertFundsFromInput`, `joinPoolFromInput`, and `convertFundsFromOutput` functions.\n\nTh...

Vulnerable code:
```\nfunction convertFundsFromInput(\n    address _from,\n    address _to,\n    uint256 _inputAmount,\n    uint256 _minOutputAmount\n) external override returns (uint256 _outputAmount) {\n    address _sender = msg.sender;\n    Transfers._pullFunds(_from, _sender, _inputAmount);\n    _inputAmount = Math._min(_inputAmount, Transfers._getBalance(_from)); // deals with potential transfer tax\n    _outputAmount = UniswapV2ExchangeAbstraction._convertFundsFromInput(router, _from, _to, _inputAmount, _minOutputAmount);\n    _outputAmount = Math._min(_outputAmount, Transfers._getBalance(_to)); // deals with potential transfer tax\n    Transfers._pushFunds(_to, _sender, _outputAmount);\n    return _outputAmount;\n}\n```\n```\nfunction joinPoolFromInput(\n    address _pool,\n    address _token,\n    uint256 _inputAmount,\n    uint256 _minOutputShares\n) external override returns (uint256 _outputShares) {\n    address _sender = msg.sender;\n    Transfers._pullFunds(_token, _sender, _inputAmount);\n    _inputAmount = Math._min(_inputAmount, Transfers._getBalance(_token)); // deals with potential transfer tax\n    _outputShares = UniswapV2LiquidityPoolAbstraction._joinPoolFromInput(\n        router,\n        _pool,\n        _token,\n        _inputAmount,\n        _minOutputShares\n    );\n    _outputShares = Math._min(_outputShares, Transfers._getBalance(_pool)); // deals with potential transfer tax\n    Transfers._pushFunds(_pool, _sender, _outputShares);\n    return _outputShares;\n}\n```\n```\nfunction convertFundsFromOutput(\n    address _from,\n    address _to,\n    uint256 _outputAmount,\n    uint256 _maxInputAmount\n) external override returns (uint256 _inputAmount) {\n    address _sender = msg.sender;\n    Transfers._pullFunds(_from, _sender, _maxInputAmount);\n    _maxInputAmount = Math._min(_maxInputAmount, Transfers._getBalance(_from)); // deals with potential transfer tax\n    _inputAmount = UniswapV2ExchangeAbstraction._convertFundsFromOutput(\n        router,\n        _from,\n        _to,\n        _outputAmount,\n        _maxInputAmount\n    );\n    uint256 _refundAmount = _maxInputAmount - _inputAmount;\n    _refundAmount = Math._min(_refundAmount, Transfers._getBalance(_from)); // deals with potential transfer tax\n    Transfers._pushFunds(_from, _sender, _refundAmount);\n    _outputAmount = Math._min(_outputAmount, Transfers._getBalance(_to)); // deals with potential transfer tax\n    Transfers._pushFunds(_to, _sender, _outputAmount);\n    return _inputAmount;\n```\n```\nfunction recoverLostFunds(address _token) external onlyOwner {\n    uint256 _balance = Transfers._getBalance(_token);\n    Transfers._pushFunds(_token, treasury, _balance);\n}\n```
MEDIUM severity: The SafeMath library, used in the contract, can potentially lead to a situation where the contract b. The SafeMath library, used in the contract, can potentially lead to a situation where the contract becomes locked up due to an unavoidable overflow. This occurs when the multiplication of the voter's balance and asset weight exceeds the maximum value that can be represented by a `uint256` variable.\...

Vulnerable code:
```\nuint256 _votingPower = _voterAssetBalance.mul(_assetWeight);\n```\n```\n_proposal.votes[_cachedVoter.vote] = \n    _proposal.votes[_cachedVoter.vote].sub(\n        _cachedVoter.balance.mul(_cachedVoter.weight)\n    );\n_proposal.totalVotes = _proposal.totalVotes.sub(1);\n```
MEDIUM severity: The CurveV2 LP Token pricing mechanism is vulnerable to an incorrect calculation of the LP token pri. The CurveV2 LP Token pricing mechanism is vulnerable to an incorrect calculation of the LP token price. The issue arises from the incorrect usage of the `internalPriceOracle` in the `lp_price` function. Specifically, the `internalPriceOracle` is used to calculate the price of the LP token as the pri...

Vulnerable code:
```\ndef lp_price() -> uint256:\n    """\n    Approximate LP token price\n    """\n    return 2 * self.virtual_price * self.sqrt_int(self.internal_price_oracle()) / 10**18\n```\n```\ndef price_oracle() -> uint256:\n    return self.internal_price_oracle()\n```\n```\nFile: CurveV2CryptoEthOracle.sol\n\nfunction registerPool(address curvePool, address curveLpToken, bool checkReentrancy) external onlyOwner {\n    /**\n     * Curve V2 pools always price second token in `coins` array in first token in `coins` array. \n     * This means that if `coins[0]` is Weth, and `coins[1]` is rEth, the price will be rEth as base and weth as quote. \n     * Hence to get lp price we will always want to use the second token in the array, priced in eth.\n     */\n    lpTokenToPool[lpToken] = \n        PoolData({ pool: curvePool, checkReentrancy: checkReentrancy? 1 : 0, tokenToPrice: tokens[1] });\n```\n```\nFile: CurveV2CryptoEthOracle.sol\n\nfunction getPriceInEth(address token) external returns (uint256 price) {\n    Errors.verifyNotZero(token, "token");\n\n    PoolData memory poolInfo = lpTokenToPool[token];\n    if (poolInfo.pool == address(0)) revert NotRegistered(token);\n\n    ICryptoSwapPool cryptoPool = ICryptoSwapPool(poolInfo.pool);\n\n    if (poolInfo.checkReentrancy == 1) {\n        cryptoPool.claim_admin_fees();\n    }\n\n    uint256 virtualPrice = cryptoPool.get_virtual_price();\n    uint256 assetPrice = systemRegistry.rootPriceOracle().getPriceInEth(poolInfo.tokenToPrice);\n\n    return (2 * virtualPrice * sqrt(assetPrice)) / 10**18;\n}\n```