Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: The `_distribute()` function in SatinVoter.sol is responsible for distributing weekly emissions to a. The `_distribute()` function in SatinVoter.sol is responsible for distributing weekly emissions to a gauge based on the percentage of total votes the associated pool received. Specifically, it is called by `updatePeriod()` on the gauge associated with the Satin / $CASH pool. The `veShare` variable i...

Vulnerable code:
```\nuint _claimable = claimable[_gauge];\n\nif (SATIN_CASH_LP_GAUGE == _gauge) {\n    veShare = calculateSatinCashLPVeShare(_claimable);\n    _claimable -= veShare;\n}\n\nif (_claimable > IMultiRewardsPool(_gauge).left(token) && _claimable / DURATION > 0) {\n    claimable[_gauge] = 0;\n    if (is4poolGauge[_gauge]) {\n        IGauge(_gauge).notifyRewardAmount(token, _claimable, true);\n    } else {\n        IGauge(_gauge).notifyRewardAmount(token, _claimable, false);\n    }\n    emit DistributeReward(msg.sender, _gauge, _claimable);\n}\n```
MEDIUM severity: The `minTokenAmounts_` variable in the BLVaultLido contract is ineffective in the new configuration,. The `minTokenAmounts_` variable in the BLVaultLido contract is ineffective in the new configuration, rendering it unable to provide any meaningful slippage protection. This is because the variable only ensures that a sufficient amount of tokens is received from the liquidity pool, but does not enfor...

Vulnerable code:
```\n_exitBalancerPool(lpAmount_, minTokenAmounts_);\n\nuint256 ohmAmountOut = ohm.balanceOf(address(this)) - ohmBefore;\nuint256 wstethAmountOut = wsteth.balanceOf(address(this)) - wstethBefore;\n\nuint256 wstethOhmPrice = manager.getTknOhmPrice();\nuint256 expectedWstethAmountOut = (ohmAmountOut * wstethOhmPrice) / _OHM_DECIMALS;\n\nuint256 wstethToReturn = wstethAmountOut > expectedWstethAmountOut\n   ? expectedWstethAmountOut\n    : wstethAmountOut;\n\nif (wstethAmountOut > wstethToReturn) {\n    wsteth.safeTransfer(TRSRY(), wstethAmountOut - wstethToReturn);\n}\n\nohm.increaseAllowance(MINTR(), ohmAmountOut);\nmanager.burnOhmFromVault(ohmAmountOut);\n\nwsteth.safeTransfer(msg.sender, wstethToReturn);\n```
MEDIUM severity: The emergency contract functions in the protocol lack a crucial mechanism to specify minimum token a. The emergency contract functions in the protocol lack a crucial mechanism to specify minimum token amounts when removing or adding liquidity during emergency situations. This oversight allows MEV bots to exploit the protocol's emergency scenario, potentially leading to significant losses.\n\nWhen an...

Vulnerable code:
```\nfunction emergencyPause(\n  GMXTypes.Store storage self\n) external {\n    self.refundee = payable(msg.sender);\n\n    GMXTypes.RemoveLiquidityParams memory _rlp;\n\n    // Remove all of the vault's LP tokens\n    _rlp.lpAmt = self.lpToken.balanceOf(address(this));\n    _rlp.executionFee = msg.value;\n\n    GMXManager.removeLiquidity(\n        self,\n        _rlp\n    );\n\n    self.status = GMXTypes.Status.Paused;\n\n    emit EmergencyPause();\n}\n```\n```\nstruct RemoveLiquidityParams {\n    uint256 lpAmt;\n    address[] tokenASwapPath;\n    address[] tokenBSwapPath;\n    uint256 minTokenAAmt;\n    uint256 minTokenBAmt;\n    uint256 executionFee;\n}\n```\n```\nfunction emergencyResume(\n  GMXTypes.Store storage self\n) external {\n    GMXChecks.beforeEmergencyResumeChecks(self);\n\n    self.status = GMXTypes.Status.Resume;\n\n    self.refundee = payable(msg.sender);\n\n    GMXTypes.AddLiquidityParams memory _alp = AddLiquidityParams(\n        tokenAAmt: self.tokenA.balanceOf(address(this)),\n        tokenBAmt: self.tokenB.balanceOf(address(this)),\n        executionFee: msg.value\n    );\n\n    GMXManager.addLiquidity(\n        self,\n        _alp\n    );\n}\n```
MEDIUM severity: The `aggregatedQueueAmount` variable is used inconsistently in the withdrawal logic, which can lead . The `aggregatedQueueAmount` variable is used inconsistently in the withdrawal logic, which can lead to incorrect calculations and potentially allow or disallow withdrawal requests that should not be processed. This variable represents the cumulative DAIx amount in the queue waiting for withdrawal, w...

Vulnerable code:
```\nrequire(totalLiquidity >= totalCoverTokens.add(aggregatedQueueAmount).add(_daiTokensToWithdraw),\n  "PB: Not enough available liquidity");\n```
MEDIUM severity: The `exchangeFromExactBase()` function in the GMXAdapter module is vulnerable to manipulation due to. The `exchangeFromExactBase()` function in the GMXAdapter module is vulnerable to manipulation due to its reliance on GMX-provided `minPrice` and `maxPrice` values. Specifically, these prices may be tampered with, as GMX supports an "AMM pricing" mode where quotes are calculated from Uniswap reserves...

Vulnerable code:
```\nuint tokenInPrice = _getMinPrice(address(baseAsset));\nuint tokenOutPrice = _getMaxPrice(address(quoteAsset));\n\nuint minOut = tokenInPrice\n   .multiplyDecimal(marketPricingParams[_optionMarket].minReturnPercent)\n   .multiplyDecimal(_amountBase)\n   .divideDecimal(tokenOutPrice);\n```
MEDIUM severity: The vulnerability allows an attacker to drain the pool by exploiting the PMMPricing algorithm's inco. The vulnerability allows an attacker to drain the pool by exploiting the PMMPricing algorithm's incorrect estimation of output amounts when an asset's balance reaches zero. This occurs when an attacker withdraws the entire balance of a specific asset, depleting the reserve to zero. Subsequently, the...

Vulnerable code:
```\nfunction test_poolCanBeDrained() public {\n    uint256 _amount = 99959990000000000000000;\n\n    vm.startPrank(tapir);\n\n    dai.transfer(address(gsp), 10 * 1e18);\n    usdc.transfer(address(gsp), 10 * 1e6);\n    gsp.buyShares(tapir);\n\n    assertTrue(gsp._BASE_RESERVE_() == 10 * 1e18);\n    assertTrue(gsp._QUOTE_RESERVE_() == 10 * 1e6);\n    assertTrue(gsp._BASE_TARGET_() == 10 * 1e18);\n    assertTrue(gsp._QUOTE_TARGET_() == 10 * 1e6);\n    assertEq(gsp.balanceOf(tapir), 10 * 1e18);\n\n    vm.stopPrank();\n\n    vm.startPrank(hippo);\n    deal(DAI, hippo, _amount);\n    dai.transfer(address(gsp), _amount);\n    uint256 receivedQuoteAmount = gsp.sellBase(hippo);\n\n    console.log("Received quote amount by hippo", receivedQuoteAmount);\n    console.log("Base reserve", gsp._BASE_RESERVE_());\n    console.log("Quote reserve", gsp._QUOTE_RESERVE_());\n\n    assertEq(gsp._QUOTE_RESERVE_(), 0);\n\n    usdc.transfer(address(gsp), receivedQuoteAmount);\n\n    uint256 receivedBaseAmount = gsp.sellQuote(hippo);\n\n    console.log("Received base amount by hippo", receivedBaseAmount);\n    console.log("Base target", gsp._BASE_TARGET_());\n    console.log("Quote target", gsp._QUOTE_TARGET_());\n    console.log("Base reserve", gsp._BASE_RESERVE_());\n    console.log("Quote reserve", gsp._QUOTE_RESERVE_());\n\n    assertGe(receivedBaseAmount, _amount);\n    console.log("Profit for attack", receivedBaseAmount - _amount);\n}\n```
MEDIUM severity: The `getTargetExternalLendingAmount` function in the `ExternalLending` contract calculates the targe. The `getTargetExternalLendingAmount` function in the `ExternalLending` contract calculates the target amount for external lending by restricting the target amount to be greater than `oracleData.maxExternalDeposit`. However, this calculation does not take into account the existing deposit `currentExt...

Vulnerable code:
```\nfunction getTargetExternalLendingAmount(\n    Token memory underlyingToken,\n    PrimeCashFactors memory factors,\n    RebalancingTargetData memory rebalancingTargetData,\n    OracleData memory oracleData,\n    PrimeRate memory pr\n) internal pure returns (uint256 targetAmount) {\n    targetAmount = SafeUint256.min(\n        uint256(underlyingToken.convertToExternal(targetExternalUnderlyingLend)),\n        SafeUint256.min(maxExternalUnderlyingLend, oracleData.maxExternalDeposit)\n    );\n```
MEDIUM severity: The vulnerability allows trusted nodes to submit multiple different observations for the same minipo. The vulnerability allows trusted nodes to submit multiple different observations for the same minipool, block, or network balances, which can lead to inconsistent and unreliable data being stored in the RocketPool contracts. This is because the contracts do not properly check for duplicate submissio...

Vulnerable code:
```\nbytes32 nodeSubmissionKey = keccak256(abi.encodePacked("minipool.withdrawable.submitted.node", msg.sender, _minipoolAddress, _stakingStartBalance, _stakingEndBalance));\nbytes32 submissionCountKey = keccak256(abi.encodePacked("minipool.withdrawable.submitted.count", _minipoolAddress, _stakingStartBalance, _stakingEndBalance));\n\nrequire(!getBool(nodeSubmissionKey), "Duplicate submission from node");\nsetBool(nodeSubmissionKey, true);\nsetBool(keccak256(abi.encodePacked("minipool.withdrawable.submitted.node", msg.sender, _minipoolAddress)), true);\n\nuint256 submissionCount = getUint(submissionCountKey).add(1);\nsetUint(submissionCountKey, submissionCount);\n```\n```\nbytes32 nodeSubmissionKey = keccak256(abi.encodePacked("network.balances.submitted.node", msg.sender, _block, _totalEth, _stakingEth, _rethSupply));\nbytes32 submissionCountKey = keccak256(abi.encodePacked("network.balances.submitted.count", _block, _totalEth, _stakingEth, _rethSupply));\n\nrequire(!getBool(nodeSubmissionKey), "Duplicate submission from node");\nsetBool(nodeSubmissionKey, true);\nsetBool(keccak256(abi.encodePacked("network.balances.submitted.node", msg.sender, _block)), true);\n\nuint256 submissionCount = getUint(submissionCountKey).add(1);\nsetUint(submissionCountKey, submissionCount);\n\nemit BalancesSubmitted(msg.sender, _block, _totalEth, _stakingEth, _rethSupply, block.timestamp);\n\n// Check submission count & update network balances\n```\n```\nbytes32 nodeSubmissionKey = keccak256(abi.encodePacked("network.prices.submitted.node", msg.sender, _block, _rplPrice));\nbytes32 submissionCountKey = keccak256(abi.encodePacked("network.prices.submitted.count", _block, _rplPrice));\n\nrequire(!getBool(nodeSubmissionKey), "Duplicate submission from node");\nsetBool(nodeSubmissionKey, true);\nsetBool(keccak256(abi.encodePacked("network.prices.submitted.node", msg.sender, _block)), true);\n\nuint256 submissionCount = getUint(submissionCountKey).add(1);\nsetUint(submissionCountKey, submissionCount);\n\nemit PricesSubmitted(msg.sender, _block, _rplPrice, block.timestamp);\n\n// Check submission count & update network prices\n```
MEDIUM severity: The `getSellRate` function is responsible for calculating the rate at which a specified amount of to. The `getSellRate` function is responsible for calculating the rate at which a specified amount of tokens can be sold, given the source and destination addresses, and the source amount. This function is used as a building block for both `getSellRate` and `getBuyRate` functions. The `getSellRate` func...

Vulnerable code:
```\nfunction getSellRate(address _srcAddr, address _destAddr, uint _srcAmount, bytes memory) public override view returns (uint rate) {\n    (rate,) = KyberNetworkProxyInterface(KYBER_INTERFACE)\n       .getExpectedRate(IERC20(_srcAddr), IERC20(_destAddr), _srcAmount);\n\n    rate *= (10 ** (18 - getDecimals(_srcAddr)));\n    rate /= (10 ** (18 - getDecimals(_destAddr)));\n}\n\n/// @notice Return a rate for which we can buy an amount of tokens\n/// @param _srcAddr From token\n/// @param _destAddr To token\n/// @param _destAmount To amount\n/// @return rate Rate\nfunction getBuyRate(address _srcAddr, address _destAddr, uint _destAmount, bytes memory _additionalData) public override view returns (uint rate) {\n    uint256 srcRate = getSellRate(_destAddr, _srcAddr, _destAmount, _additionalData);\n    uint256 srcAmount = wmul(srcRate, _destAmount);\n\n    rate = getSellRate(_srcAddr, _destAddr, srcAmount, _additionalData);\n\n    rate += rate / 30;\n}\n```
MEDIUM severity: The `compound()` function in the compoundGMX contract is designed to deposit Long tokens, Short toke. The `compound()` function in the compoundGMX contract is designed to deposit Long tokens, Short tokens, or airdropped ARB tokens to the GMX for compounding. However, the function is restricted by a condition that requires the presence of ARB tokens in the trove. If the trove only contains Long/Short...

Vulnerable code:
```\nif (_tokenInAmt > 0) {\n    self.refundee = payable(msg.sender);\n\n    self.compoundCache.compoundParams = cp;\n\n    ISwap.SwapParams memory _sp;\n\n    _sp.tokenIn = cp.tokenIn;\n    _sp.tokenOut = cp.tokenOut;\n    _sp.amountIn = _tokenInAmt;\n    _sp.amountOut = 0; // amount out minimum calculated in Swap\n    _sp.slippage = self.minSlippage;\n    _sp.deadline = cp.deadline;\n\n    GMXManager.swapExactTokensForTokens(self, _sp);\n\n    GMXTypes.AddLiquidityParams memory _alp;\n\n    _alp.tokenAAmt = self.tokenA.balanceOf(address(this));\n    _alp.tokenBAmt = self.tokenB.balanceOf(address(this));\n\n    self.compoundCache.depositValue = GMXReader.convertToUsdValue(\n        self,\n        address(self.tokenA),\n        self.tokenA.balanceOf(address(this))\n    )\n    + GMXReader.convertToUsdValue(\n        self,\n        address(self.tokenB),\n        self.tokenB.balanceOf(address(this))\n    );\n\n    GMXChecks.beforeCompoundChecks(self);\n\n    self.status = GMXTypes.Status.Compound;\n\n    _alp.minMarketTokenAmt = GMXManager.calcMinMarketSlippageAmt(\n        self,\n        self.compoundCache.depositValue,\n        cp.slippage\n    );\n\n    _alp.executionFee = cp.executionFee;\n\n    self.compoundCache.depositKey = GMXManager.addLiquidity(\n        self,\n        _alp\n    );\n}\n```
MEDIUM severity: The `getBorrowETH` function in the `Accounts` contract contains a vulnerability that can lead to a d. The `getBorrowETH` function in the `Accounts` contract contains a vulnerability that can lead to a denial-of-service (DoS) attack. This function performs multiple external calls to the `GlobalConfig` and `TokenRegistry` contracts within a for loop, which can result in a significant amount of gas con...

Vulnerable code:
```\nfunction getBorrowETH(\n    address _accountAddr\n) public view returns (uint256 borrowETH) {\n    uint tokenNum = globalConfig.tokenInfoRegistry().getCoinLength();\n    for (uint i = 0; i < tokenNum; i++) {\n        if (isUserHasBorrows(_accountAddr, uint8(i))) {\n            address tokenAddress = globalConfig.tokenInfoRegistry().addressFromIndex(i);\n            uint divisor = INT_UNIT;\n            if (tokenAddress!= ETH_ADDR) {\n                divisor = 10 ** uint256(globalConfig.tokenInfoRegistry().getTokenDecimals(tokenAddress));\n            }\n            borrowETH = borrowETH.add(getBorrowBalanceCurrent(tokenAddress, _accountAddr).mul(globalConfig.tokenInfoRegistry().priceFromIndex(i)).div(divisor));\n        }\n    }\n    return borrowETH;\n}\n```\n```\nfunction priceFromIndex(uint index) public view returns(uint256) {\n    require(index < tokens.length, "coinIndex must be smaller than the coins length.");\n    address tokenAddress = tokens[index];\n    if (Utils._isETH(address(globalConfig), tokenAddress)) {\n        return 1e18;\n    }\n    return uint256(globalConfig.chainLink().getLatestAnswer(tokenAddress));\n}\n```\n```\nfunction getBorrowBalanceCurrent(\n    address _token,\n    address _accountAddr\n) public view returns (uint256 borrowBalance) {\n    AccountTokenLib.TokenInfo storage tokenInfo = accounts[_accountAddr].tokenInfos[_token];\n\n    uint accruedRate;\n    if (tokenInfo.getBorrowPrincipal() == 0) {\n        return 0;\n    } else {\n        if (globalConfig.bank().borrowRateIndex(_token, tokenInfo.getLastBorrowBlock()) == 0) {\n            accruedRate = INT_UNIT;\n        } else {\n            accruedRate = globalConfig.bank().borrowRateIndexNow(_token)\n               .mul(INT_UNIT)\n               .div(globalConfig.bank().borrowRateIndex(_token, tokenInfo.getLastBorrowBlock()));\n        }\n        return tokenInfo.getBorrowBalance(accruedRate);\n    }\n}\n```
MEDIUM severity: The vulnerability arises when accounts that existed before the migration to a new incentive calculat. The vulnerability arises when accounts that existed before the migration to a new incentive calculation mechanism attempt to claim incentives for the first time after the migration. Specifically, the issue occurs when an account claims incentives immediately before the migration, which means in the...

Vulnerable code:
```\nuint256 timeSinceMigration = finalMigrationTime - lastClaimTime;\n\nuint256 incentiveRate = \n    timeSinceMigration\n   .mul(uint256(Constants.INTERNAL_TOKEN_PRECISION))\n   .mul(finalEmissionRatePerYear)\n   .mul(uint256(Constants.INTERNAL_TOKEN_PRECISION))\n   .div(Constants.YEAR);\n\nuint256 avgTotalSupply = finalTotalIntegralSupply.sub(lastClaimIntegralSupply).div(timeSinceMigration);\n```
MEDIUM severity: The vulnerability lies in the calculation of the Bond Price Factor (BPF) in the `_prepareTake()` fun. The vulnerability lies in the calculation of the Bond Price Factor (BPF) in the `_prepareTake()` function, which is used to determine the bond reward or penalty. The BPF is calculated using the `auctionPrice` variable, which is obtained from the `_auctionPrice()` function. However, in a specific sce...

Vulnerable code:
```\nfunction _prepareTake(\n    Liquidation memory liquidation_,\n    uint256 t0Debt_,\n    uint256 collateral_,\n    uint256 inflator_\n) internal view returns (TakeLocalVars memory vars) {\n    vars.auctionPrice = _auctionPrice(liquidation_.referencePrice, kickTime);\n    vars.bondFactor   = liquidation_.bondFactor;\n    vars.bpf          = _bpf(\n        vars.borrowerDebt,\n        collateral_,\n        neutralPrice,\n        liquidation_.bondFactor,\n        vars.auctionPrice\n    );\n```\n```\nif vars_.auctionPrice > vars_.bucketPrice:\n    revert AuctionPriceGtBucketPrice()\n\nif params_.depositTake:\n    vars_.auctionPrice = vars_.bucketPrice\n```\n```\nvars_ = _calculateTakeFlowsAndBondChange(\n    borrower_.collateral,\n    params_.inflator,\n    params_.collateralScale,\n    vars_\n)\n\n_rewardBucketTake(\n    auctions_,\n    deposits_,\n    buckets_,\n    liquidation,\n    params_.index,\n    params_.depositTake,\n    vars_\n)\n```
MEDIUM severity: The UniswapPriceAdaptor's `impact` variable is susceptible to an arithmetic overflow vulnerability, . The UniswapPriceAdaptor's `impact` variable is susceptible to an arithmetic overflow vulnerability, which can occur when the `updateImpact` function is called. This function updates the `impact` variable to a `uint32` value, which has a maximum value of 4,294,967,295. However, the `impact` variable...

Vulnerable code:
```\nfunction updateImpact(uint32 newImpact) external onlyOwner {\n    emit UpdateImpact(impact, newImpact);\n    impact = newImpact;\n}\n```\n```\nrequire(\n    diff * 1e18 / JOJOPriceFeed <= impact,\n    "deviation is too big"\n);\n```
MEDIUM severity: The TransactionManager's Relayer functionality allows users to opt-in for a service that enables the. The TransactionManager's Relayer functionality allows users to opt-in for a service that enables the relayer to withdraw funds from the sending chain after the transaction's expiry. However, this service is not optional, as the same signature is used for both the relayer's withdrawal and the user's...

Vulnerable code:
```\nrequire(msg.sender == txData.user || recoverSignature(txData.transactionId, relayerFee, "cancel", signature) == txData.user, "#C:022");\n\nAsset.transferAsset(txData.sendingAssetId, payable(msg.sender), relayerFee);\n\nuint256 toRefund;\nunchecked {\n  toRefund = amount - relayerFee;\n}\n\nif (toRefund > 0) {\n  Asset.transferAsset(txData.sendingAssetId, payable(txData.sendingChainFallback), toRefund);\n}\n\n} else {\n  // Receiver side, router liquidity is returned\n  if (txData.expiry >= block.timestamp) {\n    // Timeout has not expired and tx may only be cancelled by user\n    require(msg.sender == txData.user || recoverSignature(txData.transactionId, relayerFee, "cancel", signature) == txData.user, "#C:022");\n```
MEDIUM severity: The vulnerability arises from a lack of checks on owner additions in the `claimSigner()` function, w. The vulnerability arises from a lack of checks on owner additions in the `claimSigner()` function, which can lead to exceeding the `maxSigners` limit, causing all transactions to revert. This is particularly concerning in the context of immutable hats, where the only way to avoid permanent locking o...

Vulnerable code:
```\nif (validSignerCount > maxSigners) {\n    revert MaxSignersReached();\n}\n```
MEDIUM severity: The `initiateWithdraw()` function in the LiquidityPool contract contains a vulnerability that may pr. The `initiateWithdraw()` function in the LiquidityPool contract contains a vulnerability that may prevent small liquidity providers from withdrawing their deposits. The function checks if the withdrawn value or the amount of liquidity tokens is above a minimum parameter, `minDepositWithdraw`. Howeve...

Vulnerable code:
```\nif (withdrawalValue < lpParams.minDepositWithdraw &&\n    amountLiquidityToken < lpParams.minDepositWithdraw) {\n    revert MinimumWithdrawNotMet(address(this), withdrawalValue, lpParams.minDepositWithdraw);\n}\n```
MEDIUM severity: The vulnerability is related to the use of arithmetic casts in the code, specifically in situations . The vulnerability is related to the use of arithmetic casts in the code, specifically in situations where signed integers are used to represent negative values. The code appears to be using signed integers to indicate the withdrawal of everything, which is an unconventional approach. \n\nThe use of...

Vulnerable code:
```\nsolidity-shell\n\n🚀 Entering interactive Solidity ^0.8.11 shell. '.help' and '.exit' are your friends.\n» ganache-mgr: starting temp. ganache instance\n» uint(int(-100))\n115792089237316195423570985008687907853269984665640564039457584007913129639836\n» int256(uint(2**256-100))\n-100\n```\n```\nuint256 collateralInPlay = _getCollateralInPlay(\n    vAssets.collateralAsset,\n    vAssets.borrowAsset,\n    debtTotal + bonus\n);\n\n_burnMulti(addrs, borrowBals, vAssets, _vault, f1155);\n\nIVault(_vault).withdrawLiq(int256(collateralInPlay));\n```\n```\nuint256 collateralInPlay = _getCollateralInPlay(\n    vAssets.collateralAsset,\n    vAssets.borrowAsset,\n    _amount + _flashloanFee + bonus\n);\n\n_burnMulti(_addrs, _borrowBals, vAssets, _vault, f1155);\n\nIVault(_vault).withdrawLiq(int256(collateralInPlay));\n```\n```\nuint256 amount = _amount < 0? debtTotal : uint256(_amount);\n```\n```\nfunction withdrawLiq(uint256 _withdrawAmount) external override nonReentrant onlyFliquidator {\n    _withdraw(_withdrawAmount, address(activeProvider));\n    IERC20Upgradeable(vAssets.collateralAsset).transfer(\n        payable(msg.sender),\n        _withdrawAmount\n    );\n}\n```\n```\nfunction updateState(uint256 _assetID, uint256 newBalance) external override onlyPermit {\n    uint256 total = totalSupply(_assetID);\n    if (newBalance > 0 && total > 0 && newBalance > total) {\n        uint256 newIndex = (indexes[_assetID] * newBalance) / total;\n        indexes[_assetID] = uint128(newIndex);\n    }\n}\n```
MEDIUM severity: The Chainlink oracle feeds are not designed to be immutable, which means that the addresses of the p. The Chainlink oracle feeds are not designed to be immutable, which means that the addresses of the price feeds can be updated or removed. This is because the `addTokenPriceFeed` function in the ChainlinkARBOracle contract allows the owner to set the price feed addresses only once and reverts if an a...

Vulnerable code:
```\nfunction addTokenPriceFeed(address token, address feed) external onlyOwner {\n    if (token == address(0)) {\n        revert Errors.ZeroAddressNotAllowed();\n    }\n    if (feed == address(0)) {\n        revert Errors.ZeroAddressNotAllowed();\n    }\n    if (feeds[token]!= address(0)) {\n        revert Errors.TokenPriceFeedAlreadySet();\n    }\n    feeds[token] = feed;\n}\n```