Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: Vulnerable function: ```\n    uint extraRewardsCount = IAuraRewarder(crvRewarder)\n        .extraRewa. ```\n    uint extraRewardsCount = IAuraRewarder(crvRewarder)\n        .extraRewardsLength();\n    tokens = new address[](extraRewardsCount + 1);\n    rewards = new uint256[](extraRewardsCount + 1);\n\n    tokens[0] = IAuraRewarder(crvRewarder).rewardToken();\n    rewards[0] = _getPendingReward(\n   

Vulnerable code:
```\n    uint extraRewardsCount = IAuraRewarder(crvRewarder)\n        .extraRewardsLength();\n    tokens = new address[](extraRewardsCount + 1);\n    rewards = new uint256[](extraRewardsCount + 1);\n\n    tokens[0] = IAuraRewarder(crvRewarder).rewardToken();\n    rewards[0] = _getPendingReward(\n        stCrvPerShare,\n        crvRewarder,\n        amount,\n        lpDecimals\n    );\n\n    for (uint i = 0; i < extraRewardsCount; i++) {\n        address rewarder = IAuraRewarder(crvRewarder).extraRewards(i);\n        uint256 stRewardPerShare = accExtPerShare[tokenId][i];\n        tokens[i + 1] = IAuraRewarder(rewarder).rewardToken();\n        rewards[i + 1] = _getPendingReward(\n            stRewardPerShare,\n            rewarder,\n            amount,\n            lpDecimals\n        );\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\n    function borrow(\n        uint256 amount,\n        address to,\n        bool isDepositToJOJ. ```\n    function borrow(\n        uint256 amount,\n        address to,\n        bool isDepositToJOJO\n    ) external override nonReentrant nonFlashLoanReentrant{\n        //     t0BorrowedAmount = borrowedAmount /  getT0Rate\n        DataTypes.UserInfo storage user = userInfo[msg.sender];\n        

Vulnerable code:
```\n    function borrow(\n        uint256 amount,\n        address to,\n        bool isDepositToJOJO\n    ) external override nonReentrant nonFlashLoanReentrant{\n        //     t0BorrowedAmount = borrowedAmount /  getT0Rate\n        DataTypes.UserInfo storage user = userInfo[msg.sender];\n        _borrow(user, isDepositToJOJO, to, amount, msg.sender);\n        require(\n            _isAccountSafeAfterBorrow(user, getTRate()),\n            JUSDErrors.AFTER_BORROW_ACCOUNT_IS_NOT_SAFE\n        );\n    }\n```\n
HIGH severity: Vulnerable function: ```\nfunction _claimDeposit(\n    address owner,\n    address receiver\n)\n    internal\n    returns. ```\nfunction _claimDeposit(\n    address owner,\n    address receiver\n)\n    internal\n    returns (uint256 shares)\n{\n    shares = previewClaimDeposit(owner);\n\n    uint256 lastRequestId = lastDepositRequestId[owner];\n    uint256 assets = epochs[lastRequestId].depositRequestBalance[owner];\n  

Vulnerable code:
```\nfunction _claimDeposit(\n    address owner,\n    address receiver\n)\n    internal\n    returns (uint256 shares)\n{\n    shares = previewClaimDeposit(owner);\n\n    uint256 lastRequestId = lastDepositRequestId[owner];\n    uint256 assets = epochs[lastRequestId].depositRequestBalance[owner];\n    epochs[lastRequestId].depositRequestBalance[owner] = 0;\n    _update(address(claimableSilo), receiver, shares);\n    emit ClaimDeposit(lastRequestId, owner, receiver, assets, shares);\n}\n\nfunction previewClaimDeposit(address owner) public view returns (uint256) {\n    uint256 lastRequestId = lastDepositRequestId[owner];\n    uint256 assets = epochs[lastRequestId].depositRequestBalance[owner];\n    return _convertToShares(assets, lastRequestId, Math.Rounding.Floor);\n}\n\nfunction _convertToShares(\n    uint256 assets,\n    uint256 requestId,\n    Math.Rounding rounding\n)\n    internal\n    view\n    returns (uint256)\n{\n    if (isCurrentEpoch(requestId)) {\n        return 0;\n    }\n    uint256 totalAssets =\n        epochs[requestId].totalAssetsSnapshotForDeposit + 1;\n    uint256 totalSupply =\n        epochs[requestId].totalSupplySnapshotForDeposit + 1;\n\n    return assets.mulDiv(totalSupply, totalAssets, rounding);\n}\n```\n
HIGH severity: Vulnerable function: ```\n         struct tradeInput { \n             address spendToken;\n          . ```\n         struct tradeInput { \n             address spendToken;\n               address receiveToken;\n                 uint256 spendAmt;\n                   uint256 receiveAmtMin;\n                address routerAddress;\n         uint256 pathIndex;\n         }\n```\n

Vulnerable code:
```\n         struct tradeInput { \n             address spendToken;\n               address receiveToken;\n                 uint256 spendAmt;\n                   uint256 receiveAmtMin;\n                address routerAddress;\n         uint256 pathIndex;\n         }\n```\n
MEDIUM severity: Vulnerable function: ```\n if (amountIn > 0) {\n            // We calculate the exchange rate and the. ```\n if (amountIn > 0) {\n            // We calculate the exchange rate and the amount of underlying to be redeemed:\n            // uTokenAmount = amountIn\n            // underlyingAmount = amountIn x exchangeRateCurrent\n            uTokenAmount = amountIn;\n            underlyingAmount = (amoun

Vulnerable code:
```\n if (amountIn > 0) {\n            // We calculate the exchange rate and the amount of underlying to be redeemed:\n            // uTokenAmount = amountIn\n            // underlyingAmount = amountIn x exchangeRateCurrent\n            uTokenAmount = amountIn;\n            underlyingAmount = (amountIn * exchangeRate) / WAD;\n        } else {\n            // We get the current exchange rate and calculate the amount to be redeemed:\n            // uTokenAmount = amountOut / exchangeRate\n            // underlyingAmount = amountOut\n            uTokenAmount = (amountOut * WAD) / exchangeRate;\n            underlyingAmount = amountOut;\n        }\n```\n
MEDIUM severity: Vulnerable function: ```\nl.availableCollateral[oldBidder] += l.highestBids[tokenId][currentAuctionRo. ```\nl.availableCollateral[oldBidder] += l.highestBids[tokenId][currentAuctionRound].bidAmount;\n```\n

Vulnerable code:
```\nl.availableCollateral[oldBidder] += l.highestBids[tokenId][currentAuctionRound].bidAmount;\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction \_deposit(uint256 \_amount, address \_tranche) internal returns (uint256 \_minted) {\n. ```\nfunction \_deposit(uint256 \_amount, address \_tranche) internal returns (uint256 \_minted) {\n  // check that we are not depositing more than the contract available limit\n  \_guarded(\_amount);\n  // set \_lastCallerBlock hash\n  \_updateCallerBlock();\n  // check if strategyPrice decreased\n

Vulnerable code:
```\nfunction \_deposit(uint256 \_amount, address \_tranche) internal returns (uint256 \_minted) {\n  // check that we are not depositing more than the contract available limit\n  \_guarded(\_amount);\n  // set \_lastCallerBlock hash\n  \_updateCallerBlock();\n  // check if strategyPrice decreased\n  \_checkDefault();\n  // interest accrued since last depositXX/withdrawXX/harvest is splitted between AA and BB\n  // according to trancheAPRSplitRatio. NAVs of AA and BB are updated and tranche\n  // prices adjusted accordingly\n  \_updateAccounting();\n  // mint tranche tokens according to the current tranche price\n  \_minted = \_mintShares(\_amount, msg.sender, \_tranche);\n  // get underlyings from sender\n  IERC20Detailed(token).safeTransferFrom(msg.sender, address(this), \_amount);\n}\n```\n
MEDIUM severity: Vulnerable function: ```\n/\*\*\n \* @notice Checks that a leaf hash is contained in a root hash\n \* @param leaf Leaf ha. ```\n/\*\*\n \* @notice Checks that a leaf hash is contained in a root hash\n \* @param leaf Leaf hash to verify\n \* @param index Position of the leaf hash in the Merkle tree\n \* @param rootHash Root of the Merkle tree\n \* @param proof A Merkle proof demonstrating membership of the leaf hash\n \*

Vulnerable code:
```\n/\*\*\n \* @notice Checks that a leaf hash is contained in a root hash\n \* @param leaf Leaf hash to verify\n \* @param index Position of the leaf hash in the Merkle tree\n \* @param rootHash Root of the Merkle tree\n \* @param proof A Merkle proof demonstrating membership of the leaf hash\n \* @return True, if the leaf hash is in the Merkle tree; otherwise, False\n\*/\nfunction checkMembership(bytes32 leaf, uint256 index, bytes32 rootHash, bytes memory proof)\n    internal\n    pure\n    returns (bool)\n{\n    require(proof.length % 32 == 0, "Length of Merkle proof must be a multiple of 32");\n\n    bytes32 proofElement;\n    bytes32 computedHash = leaf;\n    uint256 j = index;\n    // Note: We're skipping the first 32 bytes of `proof`, which holds the size of the dynamically sized `bytes`\n    for (uint256 i = 32; i <= proof.length; i += 32) {\n        // solhint-disable-next-line no-inline-assembly\n        assembly {\n            proofElement := mload(add(proof, i))\n        }\n        if (j % 2 == 0) {\n            computedHash = keccak256(abi.encodePacked(computedHash, proofElement));\n        } else {\n            computedHash = keccak256(abi.encodePacked(proofElement, computedHash));\n        }\n        j = j / 2;\n    }\n\n    return computedHash == rootHash;\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction toSharesGlobal(Checkpoint memory self, UFixed6 assets) internal pure returns (UFixed6). ```\nfunction toSharesGlobal(Checkpoint memory self, UFixed6 assets) internal pure returns (UFixed6) {\n    // vault is fresh, use par value\n    if (self.shares.isZero()) return assets;\n\n    // if vault is insolvent, default to par value\n    return  self.assets.lte(Fixed6Lib.ZERO) ? assets : _to

Vulnerable code:
```\nfunction toSharesGlobal(Checkpoint memory self, UFixed6 assets) internal pure returns (UFixed6) {\n    // vault is fresh, use par value\n    if (self.shares.isZero()) return assets;\n\n    // if vault is insolvent, default to par value\n    return  self.assets.lte(Fixed6Lib.ZERO) ? assets : _toShares(self, _withoutSettlementFeeGlobal(self, assets));\n}\n\nfunction _toShares(Checkpoint memory self, UFixed6 assets) private pure returns (UFixed6) {\n    UFixed6 selfAssets = UFixed6Lib.unsafeFrom(self.assets);\n    return _withSpread(self, assets.muldiv(self.shares, selfAssets));\n}\n\nfunction _withSpread(Checkpoint memory self, UFixed6 amount) private pure returns (UFixed6) {\n    UFixed6 selfAssets = UFixed6Lib.unsafeFrom(self.assets);\n    UFixed6 totalAmount = self.deposit.add(self.redemption.muldiv(selfAssets, self.shares));\n    UFixed6 totalAmountIncludingFee = UFixed6Lib.unsafeFrom(Fixed6Lib.from(totalAmount).sub(self.tradeFee));\n\n    return totalAmount.isZero() ?\n        amount :\n        amount.muldiv(totalAmountIncludingFee, totalAmount);\n}\n\nfunction _withoutSettlementFeeGlobal(Checkpoint memory self, UFixed6 amount) private pure returns (UFixed6) {\n    return _withoutSettlementFee(amount, self.settlementFee);\n}\n\nfunction _withoutSettlementFee(UFixed6 amount, UFixed6 settlementFee) private pure returns (UFixed6) {\n    return amount.unsafeSub(settlementFee);\n}\n```\n
MEDIUM severity: Vulnerable function: ```\n    function sellUnderlying(\n        address u,\n        uint256 m,\n        uint128 a,\n     . ```\n    function sellUnderlying(\n        address u,\n        uint256 m,\n        uint128 a,\n        uint128 s\n    ) external returns (uint128) {\n        // Get the pool for the market\n        IPool pool = IPool(pools[u][m]);\n\n        // Get the number of PTs received for selling `a` underlyi

Vulnerable code:
```\n    function sellUnderlying(\n        address u,\n        uint256 m,\n        uint128 a,\n        uint128 s\n    ) external returns (uint128) {\n        // Get the pool for the market\n        IPool pool = IPool(pools[u][m]);\n\n        // Get the number of PTs received for selling `a` underlying tokens\n        uint128 expected = pool.sellBasePreview(a);\n\n        // Verify slippage does not exceed the one set by the user\n        if (expected < s) {\n            revert Exception(16, expected, 0, address(0), address(0));\n        }\n\n        // Transfer the underlying tokens to the pool\n        Safe.transferFrom(IERC20(pool.base()), msg.sender, address(pool), a);\n// rest of code\n    function sellPrincipalToken(\n        address u,\n        uint256 m,\n        uint128 a,\n        uint128 s\n    ) external returns (uint128) {\n        // Get the pool for the market\n        IPool pool = IPool(pools[u][m]);\n\n        // Preview amount of underlying received by selling `a` PTs\n        uint256 expected = pool.sellFYTokenPreview(a);\n\n        // Verify that the amount needed does not exceed the slippage parameter\n        if (expected < s) {\n            revert Exception(16, expected, s, address(0), address(0));\n        }\n\n        // Transfer the principal tokens to the pool\n        Safe.transferFrom(\n            IERC20(address(pool.fyToken())),\n            msg.sender,\n            address(pool),\n            a\n        );\n```\n
HIGH severity: Vulnerable function: ```\nfunction borrow(VerifiableCredential memory vc) external isOpen subjectIsAgentCaller(vc) {\n //. ```\nfunction borrow(VerifiableCredential memory vc) external isOpen subjectIsAgentCaller(vc) {\n // 1e18 => 1 FIL, can't borrow less than 1 FIL\n if (vc.value < WAD) revert InvalidParams();\n // can't borrow more than the pool has\n if (totalBorrowableAssets() < vc.value) revert InsufficientLiquidi

Vulnerable code:
```\nfunction borrow(VerifiableCredential memory vc) external isOpen subjectIsAgentCaller(vc) {\n // 1e18 => 1 FIL, can't borrow less than 1 FIL\n if (vc.value < WAD) revert InvalidParams();\n // can't borrow more than the pool has\n if (totalBorrowableAssets() < vc.value) revert InsufficientLiquidity();\n Account memory account = \_getAccount(vc.subject);\n // fresh account, set start epoch and epochsPaid to beginning of current window\n if (account.principal == 0) {\n uint256 currentEpoch = block.number;\n account.startEpoch = currentEpoch;\n account.epochsPaid = currentEpoch;\n GetRoute.agentPolice(router).addPoolToList(vc.subject, id);\n }\n\n account.principal += vc.value;\n account.save(router, vc.subject, id);\n\n totalBorrowed += vc.value;\n\n emit Borrow(vc.subject, vc.value);\n\n // interact - here `msg.sender` must be the Agent bc of the `subjectIsAgentCaller` modifier\n asset.transfer(msg.sender, vc.value);\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nstruct StoredTriggerOrder {\n    /* slot 0 */\n    uint8 side;                // 0 = maker, 1 =. ```\nstruct StoredTriggerOrder {\n    /* slot 0 */\n    uint8 side;                // 0 = maker, 1 = long, 2 = short, 3 = collateral\n    int8 comparison;           // -2 = lt, -1 = lte, 0 = eq, 1 = gte, 2 = gt\n    uint64 fee;                // <= 18.44tb\n    int64 price;               // <= 9.22t

Vulnerable code:
```\nstruct StoredTriggerOrder {\n    /* slot 0 */\n    uint8 side;                // 0 = maker, 1 = long, 2 = short, 3 = collateral\n    int8 comparison;           // -2 = lt, -1 = lte, 0 = eq, 1 = gte, 2 = gt\n    uint64 fee;                // <= 18.44tb\n    int64 price;               // <= 9.22t\n    int64 delta;               // <= 9.22t\n  uint48 interfaceFeeAmount; // <= 281m\n\n    /* slot 1 */\n    address interfaceFeeReceiver;\n    bool interfaceFeeUnwrap;\n    bytes11 __unallocated0__;\n}\n\nlibrary TriggerOrderLib {\n    function store(TriggerOrderStorage storage self, TriggerOrder memory newValue) internal {\n        if (newValue.side > type(uint8).max) revert TriggerOrderStorageInvalidError();\n        if (newValue.comparison > type(int8).max) revert TriggerOrderStorageInvalidError();\n        if (newValue.comparison < type(int8).min) revert TriggerOrderStorageInvalidError();\n        if (newValue.fee.gt(UFixed6.wrap(type(uint64).max))) revert TriggerOrderStorageInvalidError();\n        if (newValue.price.gt(Fixed6.wrap(type(int64).max))) revert TriggerOrderStorageInvalidError();\n        if (newValue.price.lt(Fixed6.wrap(type(int64).min))) revert TriggerOrderStorageInvalidError();\n        if (newValue.delta.gt(Fixed6.wrap(type(int64).max))) revert TriggerOrderStorageInvalidError();\n        if (newValue.delta.lt(Fixed6.wrap(type(int64).min))) revert TriggerOrderStorageInvalidError();\n      if (newValue.interfaceFee.amount.gt(UFixed6.wrap(type(uint48).max))) revert TriggerOrderStorageInvalidError();\n\n        self.value = StoredTriggerOrder(\n            uint8(newValue.side),\n            int8(newValue.comparison),\n            uint64(UFixed6.unwrap(newValue.fee)),\n            int64(Fixed6.unwrap(newValue.price)),\n            int64(Fixed6.unwrap(newValue.delta)),\n          uint40(UFixed6.unwrap(newValue.interfaceFee.amount)),\n            newValue.interfaceFee.receiver,\n            newValue.interfaceFee.unwrap,\n            bytes11(0)\n        );\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\nrequire(\n (DATASTORE.readUintForId(operatorId, "totalActiveValidators") +\. ```\nrequire(\n (DATASTORE.readUintForId(operatorId, "totalActiveValidators") +\n pubkeys.length) <= self.TELESCOPE.MONOPOLY\_THRESHOLD,\n "StakeUtils: IceBear does NOT like monopolies"\n);\n```\n

Vulnerable code:
```\nrequire(\n (DATASTORE.readUintForId(operatorId, "totalActiveValidators") +\n pubkeys.length) <= self.TELESCOPE.MONOPOLY\_THRESHOLD,\n "StakeUtils: IceBear does NOT like monopolies"\n);\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction addTokenPriceFeed(address token, address feed) external onlyOwner {\n  if (token == ad. ```\nfunction addTokenPriceFeed(address token, address feed) external onlyOwner {\n  if (token == address(0)) revert Errors.ZeroAddressNotAllowed();\n  if (feed == address(0)) revert Errors.ZeroAddressNotAllowed();\n  if (feeds[token] != address(0)) revert Errors.TokenPriceFeedAlreadySet();\n\n  fee

Vulnerable code:
```\nfunction addTokenPriceFeed(address token, address feed) external onlyOwner {\n  if (token == address(0)) revert Errors.ZeroAddressNotAllowed();\n  if (feed == address(0)) revert Errors.ZeroAddressNotAllowed();\n  if (feeds[token] != address(0)) revert Errors.TokenPriceFeedAlreadySet();\n\n  feeds[token] = feed;\n}\n```\n
HIGH severity: Vulnerable function: ```\n    function rebase(uint32 _l2Gas) external {\n        inflationMultiplier = IECO(l1Eco).getPas. ```\n    function rebase(uint32 _l2Gas) external {\n        inflationMultiplier = IECO(l1Eco).getPastLinearInflation(\n            block.number\n        );\n\n        bytes memory message = abi.encodeWithSelector(\n            IL2ECOBridge.rebase.selector,\n            inflationMultiplier\n        )

Vulnerable code:
```\n    function rebase(uint32 _l2Gas) external {\n        inflationMultiplier = IECO(l1Eco).getPastLinearInflation(\n            block.number\n        );\n\n        bytes memory message = abi.encodeWithSelector(\n            IL2ECOBridge.rebase.selector,\n            inflationMultiplier\n        );\n\n        sendCrossDomainMessage(l2TokenBridge, _l2Gas, message);\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\n_supplied = 100\n_totalSupply = 100\n\n_interest = 10\nfee = 2\n```\n. ```\n_supplied = 100\n_totalSupply = 100\n\n_interest = 10\nfee = 2\n```\n

Vulnerable code:
```\n_supplied = 100\n_totalSupply = 100\n\n_interest = 10\nfee = 2\n```\n
MEDIUM severity: Vulnerable function: ```\n## Balancer.sol\n\nfunction _sendToken(\n        address payable _oft,\n        uint256 _amount. ```\n## Balancer.sol\n\nfunction _sendToken(\n        address payable _oft,\n        uint256 _amount,\n        uint16 _dstChainId,\n        uint256 _slippage,\n>        bytes memory _data\n    ) private {\n        address erc20 = ITOFT(_oft).erc20();\n        if (IERC20Metadata(erc20).balanceOf(addr

Vulnerable code:
```\n## Balancer.sol\n\nfunction _sendToken(\n        address payable _oft,\n        uint256 _amount,\n        uint16 _dstChainId,\n        uint256 _slippage,\n>        bytes memory _data\n    ) private {\n        address erc20 = ITOFT(_oft).erc20();\n        if (IERC20Metadata(erc20).balanceOf(address(this)) < _amount) {\n            revert ExceedsBalance();\n        }\n        {\n>            (uint256 _srcPoolId, uint256 _dstPoolId) = abi.decode(_data, (uint256, uint256));\n            _routerSwap(_dstChainId, _srcPoolId, _dstPoolId, _amount, _slippage, _oft, erc20);\n        }\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\nuint256 premium = amount\_.mul(policy.weeklyPremium).div(RATIO\_BASE);\nuin. ```\nuint256 premium = amount\_.mul(policy.weeklyPremium).div(RATIO\_BASE);\nuint256 allPremium = premium.mul(toWeek\_.sub(fromWeek\_));\n```\n

Vulnerable code:
```\nuint256 premium = amount\_.mul(policy.weeklyPremium).div(RATIO\_BASE);\nuint256 allPremium = premium.mul(toWeek\_.sub(fromWeek\_));\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction execute(address to, bytes calldata data, uint256 value) external onlyOwner returns (by. ```\nfunction execute(address to, bytes calldata data, uint256 value) external onlyOwner returns (bytes memory){\n        require(to != address(0));\n->      (bool success, bytes memory returnData) = to.call{value: value}(data);\n        if (!success) {\n            assembly {\n                let p

Vulnerable code:
```\nfunction execute(address to, bytes calldata data, uint256 value) external onlyOwner returns (bytes memory){\n        require(to != address(0));\n->      (bool success, bytes memory returnData) = to.call{value: value}(data);\n        if (!success) {\n            assembly {\n                let ptr := mload(0x40)\n                let size := returndatasize()\n                returndatacopy(ptr, 0, size)\n                revert(ptr, size)\n            }\n        }\n        emit ExecuteTransaction(owner, address(this), to, data, value);\n        return returnData;\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\nFile: LMPVault.sol\n    function redeem(\n        uint256 shares,\n        address receiver,\n . ```\nFile: LMPVault.sol\n    function redeem(\n        uint256 shares,\n        address receiver,\n        address owner\n    ) public virtual override nonReentrant noNavDecrease ensureNoNavOps returns (uint256 assets) {\n        uint256 maxShares = maxRedeem(owner);\n        if (shares > maxShares)

Vulnerable code:
```\nFile: LMPVault.sol\n    function redeem(\n        uint256 shares,\n        address receiver,\n        address owner\n    ) public virtual override nonReentrant noNavDecrease ensureNoNavOps returns (uint256 assets) {\n        uint256 maxShares = maxRedeem(owner);\n        if (shares > maxShares) {\n            revert ERC4626ExceededMaxRedeem(owner, shares, maxShares);\n        }\n        uint256 possibleAssets = previewRedeem(shares); // @audit-info  round down, which is correct because user won't get too many\n\n        assets = _withdraw(possibleAssets, shares, receiver, owner);\n    }\n```\n
HIGH severity: Vulnerable function: ```\n    function _addFounders(IManager.FounderParams[] calldata _founders, uint256 reservedUntilTok. ```\n    function _addFounders(IManager.FounderParams[] calldata _founders, uint256 reservedUntilTokenId) internal {\n// rest of code\n\n                // Used to store the base token id the founder will recieve\n              uint256 baseTokenId = reservedUntilTokenId;\n\n                // For ea

Vulnerable code:
```\n    function _addFounders(IManager.FounderParams[] calldata _founders, uint256 reservedUntilTokenId) internal {\n// rest of code\n\n                // Used to store the base token id the founder will recieve\n              uint256 baseTokenId = reservedUntilTokenId;\n\n                // For each token to vest:\n                for (uint256 j; j < founderPct; ++j) {\n                    // Get the available token id\n                    baseTokenId = _getNextTokenId(baseTokenId);\n\n                    // Store the founder as the recipient\n                    tokenRecipient[baseTokenId] = newFounder;\n\n                    emit MintScheduled(baseTokenId, founderId, newFounder);\n\n                    // Update the base token id\n                    baseTokenId = (baseTokenId + schedule) % 100;\n                }\n            }\n..\n\n    function _getNextTokenId(uint256 _tokenId) internal view returns (uint256) {\n        unchecked {\n          while (tokenRecipient[_tokenId].wallet != address(0)) {\n                _tokenId = (++_tokenId) % 100;\n            }\n\n            return _tokenId;\n        }\n    }\n```\n