Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: This vulnerability refers to the lack of sanity checks for certain system-wide variables in the smar. This vulnerability refers to the lack of sanity checks for certain system-wide variables in the smart contract. Specifically, the sanity checks are missing for setting the addresses of token contracts, such as `uTokens`, `sTokens`, and `pstakeTokens`. This allows an attacker to set these variables t...

Vulnerable code:
```\nfunction setUTokensContract(address uAddress) public virtual override {\n    require(hasRole(DEFAULT_ADMIN_ROLE, _msgSender()), "LP9");\n    _uTokens = IUTokens(uAddress);\n    emit SetUTokensContract(uAddress);\n}\n\nfunction setSTokensContract(address sAddress) public virtual override {\n    require(hasRole(DEFAULT_ADMIN_ROLE, _msgSender()), "LP10");\n    _sTokens = ISTokens(sAddress);\n    emit SetSTokensContract(sAddress);\n}\n\nfunction setPSTAKEContract(address pstakeAddress) public virtual override {\n    require(hasRole(DEFAULT_ADMIN_ROLE, _msgSender()), "LP11");\n    _pstakeTokens = IPSTAKE(pstakeAddress);\n    emit SetPSTAKEContract(pstakeAddress);\n}\n```\n```\n/**\n * @dev Set 'unstake props', called from admin\n * @param unstakingLockTime: varies from 21 hours to 21 days\n *\n * Emits a {SetUnstakeProps} event with 'fee' set to the stake and unstake.\n *\n */\nfunction setUnstakingLockTime(uint256 unstakingLockTime)\n    public\n    virtual\n    returns (bool success)\n{\n    require(hasRole(DEFAULT_ADMIN_ROLE, _msgSender()), "LQ3");\n    _unstakingLockTime = unstakingLockTime;\n    emit SetUnstakingLockTime(unstakingLockTime);\n    return true;\n}\n```
MEDIUM severity: The vulnerability in the provided code block lies in the lack of a check for the Arbitrum L2 sequenc. The vulnerability in the provided code block lies in the lack of a check for the Arbitrum L2 sequencer's status before retrieving data from the Chainlink feed. This oversight can lead to potential exploitation by malicious actors during sequencer downtime. \n\nWhen the sequencer is down, the Chainli...

Vulnerable code:
```\nfunction getEthPrice() internal view returns (uint) {\n    (, int answer,, uint updatedAt,) = \n        ethUsdPriceFeed.latestRoundData();\n\n    if (block.timestamp - updatedAt >= 86400) \n        revert Errors.StalePrice(address(0), address(ethUsdPriceFeed));\n\n    if (answer <= 0) \n        revert Errors.NegativePrice(address(0), address(ethUsdPriceFeed));\n\n    return uint(answer);\n}\n```
MEDIUM severity: The `TokenSale._processPrivate()` function is designed to prevent users from depositing more than th. The `TokenSale._processPrivate()` function is designed to prevent users from depositing more than their allocated amount. However, a critical flaw exists in the logic, allowing malicious actors to bypass this restriction by utilizing multiple Ethereum addresses. This vulnerability arises from the fa...

Vulnerable code:
```\nif (userTier == 0 and giftedTierAllc == 0):\n    return 0\n```
MEDIUM severity: The stETH/ETH chainlink oracle used in the `getTknOhmPrice` function has a significant flaw, as it e. The stETH/ETH chainlink oracle used in the `getTknOhmPrice` function has a significant flaw, as it employs a 24-hour heartbeat and a 2% deviation threshold. This means that the oracle price can remain outdated for up to 24 hours, and even then, it may only update by up to 2% from its previous value....

Vulnerable code:
```\nfunction getTknOhmPrice() public view override returns (uint256) {\n    uint256 stethPerWsteth = IWsteth(pairToken).stEthPerToken();\n\n    uint256 ethPerOhm = _validatePrice(ohmEthPriceFeed.feed, ohmEthPriceFeed.updateThreshold);\n\n    uint256 stethPerEth = _validatePrice(\n        stethEthPriceFeed.feed,\n        stethEthPriceFeed.updateThreshold\n    );\n\n    return (ethPerOhm * 1e36) / (stethPerWsteth * stethPerEth);\n}\n```\n```\nuint256 wstethOhmPrice = manager.getTknOhmPrice();\nuint256 expectedWstethAmountOut = (ohmAmountOut * wstethOhmPrice) / _OHM_DECIMALS;\n\n// Take any arbs relative to the oracle price for the Treasury and return the rest to the owner\nuint256 wstethToReturn = wstethAmountOut > expectedWstethAmountOut\n   ? expectedWstethAmountOut\n    : wstethAmountOut;\n\nif (wstethAmountOut > wstethToReturn) {\n    wsteth.safeTransfer(TRSRY(), wstethAmountOut - wstethToReturn);\n}\n```
MEDIUM severity: The code relies on several assumptions about the bAssets, which can be compromised by malicious or m. The code relies on several assumptions about the bAssets, which can be compromised by malicious or malfunctioning asset contracts. This can lead to unintended behavior in the system. The code makes the following assumptions:\n\n* It assumes that the decimals of a bAsset remain constant, using the `g...

Vulnerable code:
```\nuint256 bAsset_decimals = CommonHelpers.getDecimals(_bAsset);\n```\n```\nrequire(\n    decimals >= 4 && decimals <= 18,\n    "Token must have sufficient decimal places"\n);\n```\n```\nfunction setTransferFeesFlag(address _bAsset, bool _flag)\n```
MEDIUM severity: The JUSD borrow fee rate calculation is flawed, resulting in the protocol collecting less fees than . The JUSD borrow fee rate calculation is flawed, resulting in the protocol collecting less fees than intended. The `getTRate()` function, responsible for calculating the borrow fee rate, is based on the `t0Rate` and the time difference between the current block timestamp and the last update timestamp...

Vulnerable code:
```\nfunction getTRate() public view returns (uint256) {\n    uint256 timeDifference = block.timestamp - uint256(lastUpdateTimestamp);\n    return (t0Rate + (borrowFeeRate * timeDifference) / JOJOConstant.SECONDS_PER_YEAR);\n}\n```\n```\nconstructor(\n    uint256 _maxReservesNum,\n    address _insurance,\n    address _JUSD,\n    address _JOJODealer,\n    uint256 _maxPerAccountBorrowAmount,\n    uint256 _maxTotalBorrowAmount,\n    uint256 _borrowFeeRate,\n    address _primaryAsset\n) {\n    t0Rate = JOJOConstant.ONE;\n```\n```\nlibrary JOJOConstant {\n    uint256 public constant SECONDS_PER_YEAR = 31536000;\n}\n```\n```\nfunction _borrow(\n    DataTypes.UserInfo storage user,\n    bool isDepositToJOJO,\n    address to,\n    uint256 tAmount,\n    address from\n) internal {\n    uint256 tRate = getTRate();\n    uint256 t0Amount = tAmount.decimalRemainder(tRate) \n       ? tAmount.decimalDiv(tRate) \n        : tAmount.decimalDiv(tRate) + 1;\n    user.t0BorrowBalance += t0Amount;\n```
MEDIUM severity: This vulnerability allows an attacker to delete the pending join status of any maker in any pool by . This vulnerability allows an attacker to delete the pending join status of any maker in any pool by exploiting a race condition in the `removeMakerFromStakingPool` function. The attacker can achieve this by first adding the maker to a pool using the `addMakerToStakingPool` function, passing in a `NI...

Vulnerable code:
```\npoolById[poolId].numberOfMakers = uint256(pool.numberOfMakers).safeAdd(1).downcastToUint32()\n```\n```\nbytes32 makerPoolId = getStakingPoolIdOfMaker(makerAddress);\nif (makerPoolId!= poolId) {\n    LibRichErrors.revert(\n        LibStakingRichErrors.MakerPoolAssignmentError(\n            LibStakingRichErrors.MakerPoolAssignmentErrorCodes.MakerAddressNotRegistered,\n            makerAddress,\n            makerPoolId\n        )\n    );\n}\n```\n```\ndelete _poolJoinedByMakerAddress[makerAddress];\n_poolById[poolId].numberOfMakers = uint256(_poolById[poolId].numberOfMakers).safeSub(1).downcastToUint32();\n```
MEDIUM severity: The vulnerability in the PrimeRateLib.sol file pertains to an inaccurate settlement reserve accounti. The vulnerability in the PrimeRateLib.sol file pertains to an inaccurate settlement reserve accounting issue caused by an error in the conversion between signed and unsigned integers. Specifically, when handling the conversion of `s.fCashDebtHeldInSettlementReserve` to `fCashDebtInReserve`, the code...

Vulnerable code:
```\nFile: PrimeRateLib.sol\n\nint256 fCashDebtInReserve = -int256(s.fCashDebtHeldInSettlementReserve);\nint256 primeCashInReserve = int256(s.primeCashHeldInSettlementReserve);\n\nif (fCashDebtInReserve > 0 || primeCashInReserve > 0) {\n    int256 settledPrimeCash = convertFromUnderlying(settlementRate, fCashDebtInReserve);\n    int256 excessCash;\n    if (primeCashInReserve > settledPrimeCash) {\n        excessCash = primeCashInReserve - settledPrimeCash;\n        BalanceHandler.incrementFeeToReserve(currencyId, excessCash);\n    }\n\n    Emitter.emitSettlefCashDebtInReserve(\n        currencyId, maturity, fCashDebtInReserve, settledPrimeCash, excessCash\n    );\n}\n```
MEDIUM severity: The `targetThreshold` variable is not properly validated when being set, allowing it to be set to a . The `targetThreshold` variable is not properly validated when being set, allowing it to be set to a value that is lower than the `minThreshold`. This is a critical issue because it can lead to a situation where the maximum threshold on the safe is set to a value that is less than the minimum require...

Vulnerable code:
```\nfunction _setMinThreshold(uint256 _minThreshold) internal {\n    if (_minThreshold > maxSigners || _minThreshold > targetThreshold) {\n        revert InvalidMinThreshold();\n    }\n    minThreshold = _minThreshold;\n}\n```\n```\nfunction _setTargetThreshold(uint256 _targetThreshold) internal {\n    if (_targetThreshold > maxSigners) {\n        revert InvalidTargetThreshold();\n    }\n\n    targetThreshold = _targetThreshold;\n}\n```
MEDIUM severity: The SFrxETHAdapter contract, responsible for managing esfrxETH holders' stakes in the FRAX ecosystem. The SFrxETHAdapter contract, responsible for managing esfrxETH holders' stakes in the FRAX ecosystem, contains a vulnerability that allows malicious actors to exploit the fee charged by FRAX during unstaking. Specifically, when a withdrawal request is submitted, the fee is temporarily deducted from...

Vulnerable code:
```\nFile: SFrxETHAdapter.sol\n\ncontract SFrxETHAdapter is BaseLSTAdapter, IERC721Receiver {\n    /// @title SFrxETHAdapter - esfrxETH\n    /// @dev Important security note:\n    /// 1. The vault share price (esfrxETH / WETH) increases as sfrxETH accrues staking rewards.\n    /// However, the share price decreases when frxETH (sfrxETH) is withdrawn.\n    /// Withdrawals are processed by the FraxEther redemption queue contract.\n    /// Frax takes a fee at the time of withdrawal requests, which temporarily reduces the share price.\n    /// This loss is pro-rated among all esfrxETH holders.\n    /// As a mitigation measure, we allow only authorized rebalancers to request withdrawals.\n    ///\n    /// 2. This contract doesn't independently keep track of the sfrxETH balance, so it is possible\n    /// for an attacker to directly transfer sfrxETH to this contract, increase the share price.\n```
MEDIUM severity: The Curve controller's `canRemoveLiquidity()` function is responsible for determining which tokens c. The Curve controller's `canRemoveLiquidity()` function is responsible for determining which tokens can be removed from a liquidity pool. This function is called when the `remove_liquidity()` function is invoked, which allows users to withdraw a portion of their liquidity from the pool. The `canRemov...

Vulnerable code:
```\nfunction canRemoveLiquidity(address target, bytes calldata data)\n    internal\n    view\n    returns (bool, address[] memory, address[] memory)\n{\n    (, uint256[2] memory amounts) = abi.decode(\n        data[4:],\n        (uint256, uint256[2])\n    );\n\n    address[] memory tokensOut = new address[](1);\n    tokensOut[0] = target;\n\n    uint i;\n    uint j;\n    address[] memory tokensIn = new address[](2);\n    while (i < 2) {\n        if (amounts[i] > 0) {\n            tokensIn[j++] = IStableSwapPool(target).coins(i);\n        }\n        unchecked {\n            ++i;\n        }\n    }\n    assembly {\n        mstore(tokensIn, j)\n    }\n\n    return (true, tokensIn, tokensOut);\n}\n```
MEDIUM severity: This vulnerability allows a malicious bidder to cheat an auction by placing a bid significantly high. This vulnerability allows a malicious bidder to cheat an auction by placing a bid significantly higher than the reserve price when there are outstanding liens against a token. The bidder can exploit this by placing a massive bid, knowing that only the value of the liens will be deducted from their p...

Vulnerable code:
```\nuint256[] memory liens = LIEN_TOKEN.getLiens(tokenId);\nuint256 totalLienAmount = 0;\n\nif (liens.length > 0) {\n    for (uint256 i = 0; i < liens.length; ++i) {\n        uint256 payment;\n        uint256 lienId = liens[i];\n\n        ILienToken.Lien memory lien = LIEN_TOKEN.getLien(lienId);\n\n        if (transferAmount >= lien.amount) {\n            payment = lien.amount;\n            transferAmount -= payment;\n        } else {\n            payment = transferAmount;\n            transferAmount = 0;\n        }\n        if (payment > 0) {\n            LIEN_TOKEN.makePayment(tokenId, payment, lien.position, payer);\n        }\n    }\n} else {\n    TRANSFER_PROXY.tokenTransferFrom(\n        weth,\n        payer,\n        COLLATERAL_TOKEN.ownerOf(tokenId),\n        transferAmount\n    );\n}\n```\n```\nuint256 vaultPayment = (amount - currentBid);\n\nif (firstBidTime == 0) {\n    auctions[tokenId].firstBidTime = block.timestamp.safeCastTo64();\n} else if (lastBidder!= address(0)) {\n    uint256 lastBidderRefund = amount - vaultPayment;\n    _handleOutGoingPayment(lastBidder, lastBidderRefund);\n}\n\n_handleIncomingPayment(tokenId, vaultPayment, address(msg.sender));\n\nauctions[tokenId].currentBid = amount;\nauctions[tokenId].bidder = address(msg.sender);\n```
MEDIUM severity: The Skale token, a modified ERC-777, allows users to lock a portion of their balance. This locking m. The Skale token, a modified ERC-777, allows users to lock a portion of their balance. This locking mechanism is checked during every transfer operation to ensure that the locked tokens are not transferred. However, this security measure is not extended to the `burn` function, which allows for the bu...

Vulnerable code:
```\nuint locked = _getLockedOf(from);\nif (locked > 0) {\n    require(_balances[from] >= locked + amount, "Token should be unlocked for transferring");\n}\n\n_balances[from] = _balances[from].sub(amount);\n_balances[to] = _balances[to].add(amount);\n```
MEDIUM severity: The `Delay.execute` function does not adhere to the "checks-effects-interactions" pattern, which is . The `Delay.execute` function does not adhere to the "checks-effects-interactions" pattern, which is a fundamental principle in secure smart contract development. Specifically, it deletes a delayed script only after the script has been executed, rather than checking the script's execution status befo...

Vulnerable code:
```\n/**\n * @notice Execute the script with ID `_delayedScriptId`\n * @param _delayedScriptId The ID of the script to execute\n */\nfunction execute(uint256 _delayedScriptId) external {\n    require(canExecute(_delayedScriptId), ERROR_CAN_NOT_EXECUTE);\n    runScript(delayedScripts[_delayedScriptId].evmCallScript, new bytes(0), new address[](0));\n\n    delete delayedScripts[_delayedScriptId];\n\n    emit ExecutedScript(_delayedScriptId);\n}\n```
MEDIUM severity: The delegation limitation in the voting power management system is a critical issue that restricts t. The delegation limitation in the voting power management system is a critical issue that restricts the efficient and dynamic management of delegated voting power. The system is constrained by two hard limits: the maximum number of tokens that can be delegated to a single user (maxTokenIdsDelegated)...

Vulnerable code:
```\nfunction delegateMgCvg(uint256 _tokenId, address _to, uint96 _percentage) external onlyTokenOwner(_tokenId) {\n    require(_percentage <= 100, "INVALID_PERCENTAGE");\n\n    uint256 _delegateesLength = delegatedMgCvg[_tokenId].length;\n    require(_delegateesLength < maxMgDelegatees, "TOO_MUCH_DELEGATEES");\n\n    uint256 tokenIdsDelegated = mgCvgDelegatees[_to].length;\n    require(tokenIdsDelegated < maxTokenIdsDelegated, "TOO_MUCH_MG_TOKEN_ID_DELEGATED");\n```\n```\nit("maxTokenIdsDelegated is reached => Cannot update percentage of delegate", async function () {\n    (await lockingPositionDelegate.maxTokenIdsDelegated()).should.be.equal(25);\n    await lockingPositionDelegate.connect(treasuryDao).setMaxTokenIdsDelegated(3);\n    (await lockingPositionDelegate.maxTokenIdsDelegated()).should.be.equal(3);\n\n    await lockingPositionDelegate.connect(user1).delegateMgCvg(1, user10, 20);\n    await lockingPositionDelegate.connect(user2).delegateMgCvg(2, user10, 30);\n    await lockingPositionDelegate.connect(user3).delegateMgCvg(3, user10, 30);\n\n    const txFail = lockingPositionDelegate.connect(user1).delegateMgCvg(1, user10, 40);\n    await expect(txFail).to.be.revertedWith("TOO_MUCH_MG_TOKEN_ID_DELEGATED");\n});\n\nit("maxTokenIdsDelegated IS DECREASED => PERCENTAGE UPDATE IS NO LONGER POSSIBLE", async function () {\n    await lockingPositionDelegate.connect(treasuryDao).setMaxTokenIdsDelegated(25);\n    (await lockingPositionDelegate.maxTokenIdsDelegated()).should.be.equal(25);\n\n    await lockingPositionDelegate.connect(user1).delegateMgCvg(1, user10, 20);\n    await lockingPositionDelegate.connect(user2).delegateMgCvg(2, user10, 30);\n    await lockingPositionDelegate.connect(user3).delegateMgCvg(3, user10, 30);\n\n    await lockingPositionDelegate.connect(treasuryDao).setMaxTokenIdsDelegated(3);\n    (await lockingPositionDelegate.maxTokenIdsDelegated()).should.be.equal(3);\n\n    const txFail = lockingPositionDelegate.connect(user1).delegateMgCvg(1, user10, 40);\n    await expect(txFail).to.be.revertedWith("TOO_MUCH_MG_TOKEN_ID_DELEGATED");\n    await lockingPositionDelegate.connect(treasuryDao).setMaxTokenIdsDelegated(25);\n    (await lockingPositionDelegate.maxTokenIdsDelegated()).should.be.equal(25);\n});\n\nit("maxMgDelegatees : TRY TO UPDATE PERCENTAGE DELEGATED TO A USER IF WE ALREADY REACH maxMgDelegatees", async function () {\n    await lockingPositionDelegate.connect(tre\n```
MEDIUM severity: The vulnerability lies in the calculation of the shares to be minted as a fee, which is based on the. The vulnerability lies in the calculation of the shares to be minted as a fee, which is based on the formula `shares2mint = fees * (totalSupply / totalAssets())`. This formula is incorrect and does not accurately reflect the value of the shares being minted.\n\nIn the given scenario, the `profit` is...

Vulnerable code:
```\nFile: LMPVault.sol\n\ndef calculateFees():\n    profit = (currentNavPerShare - effectiveNavPerShareHighMark) * totalSupply\n    fees = profit.mulDiv(performanceFeeBps, (MAX_FEE_BPS ** 2), Math.Rounding.Up)\n    if fees > 0 and sink!= address(0):\n        shares = _convertToShares(fees, Math.Rounding.Up)\n        _mint(sink, shares)\n        emit Deposit(address(this), sink, fees, shares)\n```
MEDIUM severity: The `UniswapSingleEthRouter` contract contains two assertions that may potentially fail, which could. The `UniswapSingleEthRouter` contract contains two assertions that may potentially fail, which could lead to unintended consequences. The first assertion checks that the message sender is the `WETH` contract, allowing only ETH to be sent via the fallback function. The second assertion verifies that...

Vulnerable code:
```\nassert(msg.sender == address(WETH))  # only accept ETH via fallback from the WETH contract\n```\n```\nassert(IWETH(WETH).transfer(address(PAIR), amountIn))\n```
MEDIUM severity: The vulnerability in the `liquidate()` function allows a liquidator to exploit a rounding-down preci. The vulnerability in the `liquidate()` function allows a liquidator to exploit a rounding-down precision error, enabling them to reduce their own debt while gaining collateral from another borrower. This is achieved by taking advantage of the function's use of a rounding-down operation when calculat...

Vulnerable code:
```\nfunction testLiquidateSteal() external {\n    uint loanTokenAmount = 12000;\n    uint borrowAmount = 1000;\n    uint collateralAmountA = 10000;\n    uint collateralAmountB = 1400;\n    MockERC20 collateralToken = new MockERC20(collateralAmountA + collateralAmountB, 18);\n    MockERC20 loanToken = new MockERC20(loanTokenAmount, 18);\n    Pool pool = factory.deploySurgePool(IERC20(address(collateralToken)), IERC20(address(loanToken)), 0.8e18, 0.5e18, 1e15, 1e15, 0.1e18, 0.4e18, 0.6e18);\n\n    loanToken.approve(address(pool), loanTokenAmount);\n    pool.deposit(loanTokenAmount);\n\n    // Alice borrows 1000\n    collateralToken.transfer(address(1), collateralAmountB);\n    vm.prank(address(1));\n    collateralToken.approve(address(pool), collateralAmountB);\n    vm.prank(address(1));\n    pool.addCollateral(address(1), collateralAmountB);\n    vm.prank(address(1));\n    pool.borrow(borrowAmount);\n\n    // Bob borrows 1000 too\n    collateralToken.approve(address(pool), collateralAmountA);\n    pool.addCollateral(address(this), collateralAmountA);\n    pool.borrow(borrowAmount);\n\n    // Bob's debt becomes 1200\n    vm.warp(block.timestamp + 365 days);\n    pool.withdraw(0);\n    uint myDebt = pool.getDebtOf(pool.debtSharesBalanceOf(address(this)), pool.debtSharesSupply(), pool.lastTotalDebt());\n    assertEq(myDebt, 1200);\n\n    // Alice's debt becomes 1200\n    uint address1Debt = pool.getDebtOf(pool.debtSharesBalanceOf(address(1)), pool.debtSharesSupply(), pool.lastTotalDebt());\n    assertEq(address1Debt, 1200);\n    assertEq(pool.lastTotalDebt(), 2399);\n\n    uint myCollateralBeforeLiquidate = collateralToken.balanceOf(address(this));\n\n    // liquidate 200 for Alice\n    loanToken.approve(address(pool), 200);\n    for (int i; i < 200; i++) {\n        pool.liquidate(address(1), 1);\n    }\n\n    // Alice's debt shares are NOT reduced\n```
MEDIUM severity: The `TrimmedAmount` library contains a vulnerability in its `shift` function, which can lead to a si. The `TrimmedAmount` library contains a vulnerability in its `shift` function, which can lead to a silent overflow when casting a scaled amount to a `uint64` value. This vulnerability occurs because the `shift` function does not perform a check to ensure that the scaled amount does not exceed the max...

Vulnerable code:
```\nif (amountScaled > uint64.max) {\n    revert AmountTooLarge(amountScaled);\n}\n```\n```\nfunction shift(\n    TrimmedAmount memory amount,\n    uint8 toDecimals\n) internal pure returns (TrimmedAmount memory) {\n    uint8 actualToDecimals = minUint8(TRIMMED_DECIMALS, toDecimals);\n    return TrimmedAmount(\n        uint64(\n            scale(\n                amount.amount,\n                amount.decimals,\n                actualToDecimals\n            ),\n            actualToDecimals\n        )\n    );\n}\n```