Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: The protocol reserve within a LToken vault, intended to serve as a liquidity backstop or compensatio. The protocol reserve within a LToken vault, intended to serve as a liquidity backstop or compensation for the protocol, can be lent out to borrowers. This is due to the inconsistent implementation of the protocol reserve calculation across the protocol. \n\nThe `totalAssets` function, which calculat...

Vulnerable code:
```\nfunction totalAssets() public view override returns (uint) {\n    return asset.balanceOf(address(this)) \n        + getBorrows() \n        - getReserves();\n}\n```\n```\nfunction getBorrows() public view returns (uint) {\n    return borrows + borrows.mulWadUp(getRateFactor());\n}\n```\n```\nfunction getReserves() public view returns (uint) {\n    return reserves + borrows.mulWadUp(getRateFactor())\n       .mulWadUp(reserveFactor);\n}\n```\n```\n/**\n    @notice Lends a specified amount of underlying asset to an account\n    @param account Address of account\n    @param amt Amount of token to lend\n    @return isFirstBorrow Returns if the account is borrowing the asset for\n        the first time\n*/\n\nfunction lendTo(address account, uint amt)\n    external\n    whenNotPaused\n    accountManagerOnly\n    returns (bool isFirstBorrow)\n{\n    updateState();\n    isFirstBorrow = (borrowsOf[account] == 0);\n\n    uint borrowShares;\n    require((borrowShares = convertAssetToBorrowShares(amt))!= 0, "ZERO_BORROW_SHARES");\n    totalBorrowShares += borrowShares;\n    borrowsOf[account] += borrowShares;\n\n    borrows += amt;\n    asset.safeTransfer(account, amt);\n    return isFirstBorrow;\n}\n```
MEDIUM severity: The `setSymbolsPrice` function in the `LiquidationFacetImpl` contract is vulnerable to an imbalance . The `setSymbolsPrice` function in the `LiquidationFacetImpl` contract is vulnerable to an imbalance in the distribution of the liquidation fee. This vulnerability allows malicious liquidators to exploit the system by only partially completing the liquidation process, thereby maximizing their gains a...

Vulnerable code:
```\nFile: LiquidationFacetImpl.sol\n\nfunction setSymbolsPrice(address partyA, PriceSig memory priceSig) internal {\n    if (accountLayout.liquidationDetails[partyA].liquidationType == LiquidationType.NONE) {\n        accountLayout.liquidationDetails[partyA] = LiquidationDetail({\n            liquidationType: LiquidationType.NONE,\n            upnl: priceSig.upnl,\n            totalUnrealizedLoss: priceSig.totalUnrealizedLoss,\n            deficit: 0,\n            liquidationFee: 0\n        });\n        AccountStorage.layout().liquidators[partyA].push(msg.sender);\n    } else {\n        require(\n            accountLayout.liquidationDetails[partyA].upnl == priceSig.upnl &&\n            accountLayout.liquidationDetails[partyA].totalUnrealizedLoss == priceSig.totalUnrealizedLoss,\n            "LiquidationFacet: Invalid upnl sig"\n        );\n    }\n}\n```
MEDIUM severity: The UniswapFeature's allowance check for a potentially "greedy" token involves a non-static call to . The UniswapFeature's allowance check for a potentially "greedy" token involves a non-static call to the token's ERC20 `allowance()` function. This call is made using the `call()` function, which allows state-changing operations to occur before control is returned to the UniswapFeature. This non-stat...

Vulnerable code:
```\nmstore(0xB00, ALLOWANCE_CALL_SELECTOR_32)\nmstore(0xB04, caller())\nmstore(0xB24, address())\nlet success := call(gas(), token, 0, 0xB00, 0x44, 0xC00, 0x20)\n```
MEDIUM severity: This vulnerability occurs when a contract uses the `call()` function to interact with another contra. This vulnerability occurs when a contract uses the `call()` function to interact with another contract, but does not properly handle the returned data. Specifically, when the returned data is not required, using `call()` can lead to gas griefing attacks.\n\nGas griefing attacks occur when an attacke...

Vulnerable code:
```\n(bool sentToUser, ) = recipient.call{ value: finalUserAmount }("");\nrequire(sentToUser, "Failed to send Ether");\n```\n```\n(bool sentToUser, bytes memory data) = recipient.call{ value: finalUserAmount }("");\nrequire(sentToUser, "Failed to send Ether");\n```
MEDIUM severity: The vulnerability in the liquidation process allows a malicious user to manipulate the liquidation p. The vulnerability in the liquidation process allows a malicious user to manipulate the liquidation process, preventing the liquidator from receiving their ETH bonus (ante). This occurs when a user's account goes into bad debt, and the liquidator attempts to liquidate the account. The liquidation pro...

Vulnerable code:
```\nfunction test_badDebtLiquidationAnte() public {\n    uint256 margin0 = 1e18;\n    uint256 borrows0 = 100e18;\n\n    deal(address(asset0), address(account), margin0);\n\n    bytes memory data = abi.encode(Action.BORROW, borrows0, 0);\n    account.modify(this, data, 1 << 32);\n\n    _setInterest(lender0, 15000);\n\n    emit log_named_uint("User borrow:", lender0.borrowBalance(address(account)));\n    emit log_named_uint("User assets:", asset0.balanceOf(address(account)));\n\n    account.warn(1 << 32);\n\n    skip(LIQUIDATION_GRACE_PERIOD);\n    lender0.accrueInterest();\n\n    vm.expectRevert();\n    account.liquidate(this, bytes(""), 1, 1 << 32);\n\n    account.liquidate(this, bytes(""), type(uint256).max, 1 << 32);\n\n    emit log_named_uint("Liquidated User borrow:", lender0.borrowBalance(address(account)));\n    emit log_named_uint("Liquidated User assets:", asset0.balanceOf(address(account)));\n    emit log_named_uint("Liquidated User ante:", address(account).balance);\n}\n```\n```\nUser borrow:: 150000000000000000000\nUser assets:: 101000000000000000000\nLiquidated User borrow:: 49000000162000000001\nLiquidated User assets:: 0\nLiquidated User ante:: 10000000000000001\n```
MEDIUM severity: The `claimTokens` method in the `TokenDistributor` class requires a series of checks before distribu. The `claimTokens` method in the `TokenDistributor` class requires a series of checks before distributing tokens. Upon closer inspection, it becomes apparent that some of these checks can be simplified and optimized. Specifically, the `hashMatch` method, which is only utilized once, can be eliminated...

Vulnerable code:
```\nrequire(hashMatch(user_id, user_address, user_amount, delegate_address, leaf, eth_signed_message_hash_hex), 'TokenDistributor: Hash Mismatch.');\n```\n```\nreturn getDigest(claim) == eth_signed_message_hash_hex;\n```\n```\nhashClaim(claim)\n```
MEDIUM severity: The `distribute()` function in the RocketNodeDistributorDelegate contract is vulnerable to reentranc. The `distribute()` function in the RocketNodeDistributorDelegate contract is vulnerable to reentrancy attacks due to its lack of protection against recursive calls. This function is responsible for distributing the contract's balance between the node operator and the user, with the node operator rec...

Vulnerable code:
```\nfunction distribute() override external {\n    uint256 nodeShare = getNodeShare();\n    address withdrawalAddress = rocketStorage.getNodeWithdrawalAddress(nodeAddress);\n    (bool success,) = withdrawalAddress.call{value : nodeShare}("");\n    require(success);\n    uint256 userShare = address(this).balance;\n    address rocketTokenRETH = rocketStorage.getAddress(rocketTokenRETHKey);\n    payable(rocketTokenRETH).transfer(userShare);\n    emit FeesDistributed(nodeAddress, userShare, nodeShare, block.timestamp);\n}\n```\n```\nfunction setWithdrawalAddress(address _nodeAddress, address _newWithdrawalAddress, bool _confirm) external override {\n    require(_newWithdrawalAddress!= address(0x0), "Invalid withdrawal address");\n    address withdrawalAddress = getNodeWithdrawalAddress(_nodeAddress);\n    require(withdrawalAddress == msg.sender, "Only a tx from a node's withdrawal address can update it");\n    if (_confirm) {\n        updateWithdrawalAddress(_nodeAddress, _newWithdrawalAddress);\n    } else {\n        pendingWithdrawalAddresses[_nodeAddress] = _newWithdrawalAddress;\n    }\n}\n```
MEDIUM severity: The vulnerability allows an attacker to claim Convex rewards for any account, including those that d. The vulnerability allows an attacker to claim Convex rewards for any account, including those that do not have any earned rewards. This is achieved by exploiting the `getReward` function in the Convex contract, which allows anyone to claim rewards for any account without verifying the account's elig...

Vulnerable code:
```\nfunction getReward(address _account, bool _claimExtras) public updateReward(_account) returns (bool) {\n    uint256 reward = earned(_account);\n    if (reward > 0) {\n        rewards[_account] = 0;\n        rewardToken.safeTransfer(_account, reward);\n        IDeposit(operator).rewardClaimed(pid, _account, reward);\n        emit RewardPaid(_account, reward);\n    }\n\n    if (_claimExtras) {\n        for (uint i = 0; i < extraRewards.length; i++) {\n            IRewards(extraRewards[i]).getReward(_account);\n        }\n    }\n    return true;\n}\n```\n```\nfunction _claimRewards(\n    address gauge,\n    address defaultToken,\n    address sendTo\n) internal returns (uint256[] memory amounts, address[] memory tokens) {\n    uint256[] memory balancesBefore = new uint256[](totalLength);\n    uint256[] memory amountsClaimed = new uint256[](totalLength);\n\n    for (uint256 i = 0; i < totalLength; ++i) {\n        uint256 balance = 0;\n        if (IERC20(rewardTokens[i]).totalSupply() > 0) {\n            balance = IERC20(rewardTokens[i]).balanceOf(account);\n        }\n        amountsClaimed[i] = balance - balancesBefore[i];\n    }\n\n    return (amountsClaimed, rewardTokens);\n}\n```
MEDIUM severity: The `convertFromStorage()` function, responsible for converting `storedCashBalance` into `signedPrim. The `convertFromStorage()` function, responsible for converting `storedCashBalance` into `signedPrimeSupplyValue`, fails to utilize rounding-up when processing negative `storedCashBalance` values. Specifically, when `storedCashBalance` represents a debt - a positive prime cash owed - the division op...

Vulnerable code:
```\nreturn storedCashBalance.mul(pr.debtFactor).div(pr.supplyFactor);\n```\n```\nfunction testMod() public {\n    int256 result = -14;\n    result = result / 4;\n    console2.logInt(result);\n}\n```
MEDIUM severity: The `MarginTrading.executeOperation` function is a critical component of the protocol's flash loan m. The `MarginTrading.executeOperation` function is a critical component of the protocol's flash loan mechanism, responsible for executing trades and managing debt positions. However, a vulnerability has been identified in this function, which allows an attacker to exploit the system by initiating a fl...

Vulnerable code:
```\ndaiAToken.balance = 30000\nwethDebtToken.balance = 10\n\nThe price of WETH when the trade was opened was ~ 3000 DAI\n```
MEDIUM severity: The vulnerability is related to the incorrect adjustment of a user's total claimable value. When the. The vulnerability is related to the incorrect adjustment of a user's total claimable value. When the owner attempts to adjust the user's total claimable value, the `records[beneficiary].total` is updated with the new value. However, this update is not correctly reflected in the `_executeClaim` funct...

Vulnerable code:
```\nfunction claim(\n    address beneficiary\n) external \n    validSaleParticipant(beneficiary)\n    nonReentrant\n{\n    uint256 claimableAmount = getClaimableAmount(beneficiary);\n    uint256 purchasedAmount = getPurchasedAmount(beneficiary);\n\n    uint256 claimedAmount = super._executeClaim(beneficiary, purchasedAmount);\n\n    super._settleClaim(beneficiary, claimedAmount);\n}\n```\n```\nfunction _executeClaim(\n    address beneficiary,\n    uint256 _totalAmount\n) internal virtual returns (uint256) {\n    uint120 totalAmount = uint120(_totalAmount);\n\n    if (records[beneficiary].total!= totalAmount) {\n      // re-initialize if the total has been updated\n      _initializeDistributionRecord(beneficiary, totalAmount);\n    }\n\n    uint120 claimableAmount = uint120(getClaimableAmount(beneficiary));\n    require(claimableAmount > 0, 'Distributor: no more tokens claimable right now');\n\n    records[beneficiary].claimed += claimableAmount;\n    claimed += claimableAmount;\n\n    return claimableAmount;\n}\n```\n```\nif (records[beneficiary].total!= totalAmount):\n    # re-initialize if the total has been updated\n    _initializeDistributionRecord(beneficiary, totalAmount)\n```
MEDIUM severity: The `valueToShares` function in the `GMXTypes.Store` contract is vulnerable to a critical issue that. The `valueToShares` function in the `GMXTypes.Store` contract is vulnerable to a critical issue that can result in immediate losses for depositors when the equity value becomes zero. This occurs when the equity value, calculated as the difference between the total asset value and total debt value, r...

Vulnerable code:
```\nfunction processDeposit(GMXTypes.Store storage self) external {\n    self.depositCache.healthParams.equityAfter = GMXReader.equityValue(self);\n    self.depositCache.sharesToUser = GMXReader.valueToShares(\n        self,\n        self.depositCache.healthParams.equityAfter - self.depositCache.healthParams.equityBefore,\n        self.depositCache.healthParams.equityBefore\n    );\n\n    GMXChecks.afterDepositChecks(self);\n}\n\nfunction valueToShares(GMXTypes.Store storage self, uint256 value, uint256 currentEquity)\n    public\n    view\n    returns (uint256)\n{\n    uint256 _sharesSupply = IERC20(address(self.vault)).totalSupply() + pendingFee(self); // shares is added\n    if (_sharesSupply == 0 || currentEquity == 0) return value;\n    return value * _sharesSupply / currentEquity;\n}\n```
MEDIUM severity: The `_vote()` function is designed to allow voting on a pool only when the current amount of votes p. The `_vote()` function is designed to allow voting on a pool only when the current amount of votes plus the new votes does not exceed the maximum allowed votes for that pool. This maximum limit is determined by the `_calculateMaxVotePossible()` function, which takes into account the total voting pow...

Vulnerable code:
```\nrequire(_poolWeights <= _calculateMaxVotePossible(_pool), "Max votes exceeded")\n```\n```\nreturn ((totalVotingPower * maxVotesForPool[_pool]) / 100)\n```
MEDIUM severity: The `getLockedCount` function iterates over the entire history of delegations for a specific holder,. The `getLockedCount` function iterates over the entire history of delegations for a specific holder, which can lead to a significant performance issue and potential gas limit exhaustion. This is because the function retrieves all delegation IDs for the given holder, and then iterates over each ID to...

Vulnerable code:
```\nfunction getLockedCount(address holder) external returns (uint amount) {\n    amount = 0;\n    DelegationController delegationController = DelegationController(contractManager.getContract("DelegationController"));\n    uint[] memory delegationIds = delegationController.getDelegationsByHolder(holder);\n\n    for (uint i = 0; i < delegationIds.length; i++) {\n        uint id = delegationIds[i];\n        if (isLocked(getState(id))) {\n            amount += delegationController.getDelegation(id).amount;\n        }\n    }\n\n    return amount + getPurchasedAmount(holder) + this.getSlashedAmount(holder);\n}\n```
MEDIUM severity: The vulnerability arises when the rebalancing of unhealthy currencies is delayed due to the cancella. The vulnerability arises when the rebalancing of unhealthy currencies is delayed due to the cancellation of a rebalancing transaction. This occurs when the `checkRebalance` function identifies that a currency is unhealthy and requires rebalancing, but before the rebalancing transaction is executed,...

Vulnerable code:
```\nFile: TreasuryAction.sol\n\nfunction _rebalanceCurrency(uint16 currencyId, bool useCooldownCheck) private {\n    RebalancingContextStorage memory context = LibStorage.getRebalancingContext()[currencyId];\n    // Accrues interest up to the current block before any rebalancing is executed\n    IPrimeCashHoldingsOracle oracle = PrimeCashExchangeRate.getPrimeCashHoldingsOracle(currencyId);\n    PrimeRate memory pr = PrimeRateLib.buildPrimeRateStateful(currencyId);\n\n    bool hasCooldownPassed = _hasCooldownPassed(context);\n    (bool isExternalLendingUnhealthy, OracleData memory oracleData, uint256 targetAmount) = \n        _isExternalLendingUnhealthy(currencyId, oracle, pr);\n\n    // Cooldown check is bypassed when the owner updates the rebalancing targets\n    if (useCooldownCheck) require(hasCooldownPassed || isExternalLendingUnhealthy);\n```
MEDIUM severity: The vulnerability in the RocketDAONodeTrustedActions contract allows non-DAO members to access ETH p. The vulnerability in the RocketDAONodeTrustedActions contract allows non-DAO members to access ETH provided by other nodes without providing any value in return. This is because the `challengeCost` is locked within the contract and not returned or recycled as system collateral. \n\nIn the event of a...

Vulnerable code:
```\nfunction actionChallengeMake(address _nodeAddress) override external onlyTrustedNode(_nodeAddress) onlyRegisteredNode(msg.sender) onlyLatestContract("rocketDAONodeTrustedActions", address(this)) payable {\n    RocketDAONodeTrustedInterface rocketDAONode = RocketDAONodeTrustedInterface(getContractAddress("rocketDAONodeTrusted"));\n    RocketDAONodeTrustedSettingsMembersInterface rocketDAONodeTrustedSettingsMembers = RocketDAONodeTrustedSettingsMembersInterface(getContractAddress("rocketDAONodeTrustedSettingsMembers"));\n\n    if (rocketDAONode.getMemberIsValid(msg.sender)!= true) {\n        require(msg.value == rocketDAONodeTrustedSettingsMembers.getChallengeCost(), "Non DAO members must pay ETH to challenge a member's node");\n    }\n\n    require(msg.sender!= _nodeAddress, "You cannot challenge yourself");\n\n    // Is this member already being challenged?\n```
MEDIUM severity: The RocketDAOProposals system allows proposals to be voted on and passed when they enter the `ACTIVE. The RocketDAOProposals system allows proposals to be voted on and passed when they enter the `ACTIVE` state. The voting period commences when the current block number exceeds the `startBlock` specified in the proposal, provided that the `startBlock` is set to a value greater than the block number at...

Vulnerable code:
```\nrequire(\n    _startBlock > block.number,\n    "Proposal start block must be in the future"\n);\nrequire(\n    _durationBlocks > 0,\n    "Proposal cannot have a duration of 0 blocks"\n);\nrequire(\n    _expiresBlocks > 0,\n    "Proposal cannot have a execution expiration of 0 blocks"\n);\nrequire(\n    _votesRequired > 0,\n    "Proposal cannot have a 0 votes required to be successful"\n);\n```\n```\nsetSettingUint('proposal.vote.delay.blocks', 1);\n```
MEDIUM severity: The `LibShortRecord::burnNFT()` function emits an incorrect event value for the `nft.owner` paramete. The `LibShortRecord::burnNFT()` function emits an incorrect event value for the `nft.owner` parameter. This issue arises due to the deletion of the `nft` variable's storage object before the `Transfer` event is emitted. The `nft` variable points to the storage object specified by the `tokenId`, whic...

Vulnerable code:
```\nfunction burnNFT(uint256 tokenId) internal {\n    AppStorage storage s = appStorage();\n    STypes.NFT storage nft = s.nftMapping[tokenId];\n    if (nft.owner == address(0)) revert Errors.NotMinted();\n    address asset = s.assetMapping[nft.assetId];\n    STypes.ShortRecord storage short = s.shortRecords[asset][nft.owner][nft.shortRecordId];\n    delete s.nftMapping[tokenId];\n    delete s.getApproved[tokenId];\n    delete short.tokenId;\n    emit Events.Transfer(nft.owner, address(0), tokenId);\n```
MEDIUM severity: The Balancer stable pool's `getTokenPriceFromStablePool` function is vulnerable to incorrect price c. The Balancer stable pool's `getTokenPriceFromStablePool` function is vulnerable to incorrect price calculations for tokens due to the amplification parameter update mechanism. When the amplification factor is being updated, the current amplification parameter used for calculating the invariant can d...

Vulnerable code:
```\nfunction getTokenPriceFromStablePool(\n    address lookupToken_,\n    uint8 outputDecimals_,\n    bytes calldata params_\n) external view returns (uint256) {\n    try pool.getLastInvariant() returns (uint256, uint256 ampFactor) {\n        lookupTokensPerDestinationToken = StableMath._calcOutGivenIn(\n            ampFactor,\n            balances_,\n            destinationTokenIndex,\n            lookupTokenIndex,\n            1e18,\n            StableMath._calculateInvariant(ampFactor, balances_)\n        );\n    }\n```\n```\nfunction startAmplificationParameterUpdate(uint256 rawEndValue, uint256 endTime) external authenticate {\n\n    // @audit the amplification parameter can be updated\n\n    function _onSwapGivenIn(\n        SwapRequest memory swapRequest,\n        uint256[] memory balances,\n        uint256 indexIn,\n        uint256 indexOut\n    ) internal virtual override whenNotPaused returns (uint256) {\n        (uint256 currentAmp, ) = _getAmplificationParameter();\n        uint256 amountOut = StableMath._calcOutGivenIn(currentAmp, balances, indexIn, indexOut, swapRequest.amount);\n        return amountOut;\n    }\n```
MEDIUM severity: The `ContractDetails` struct, utilized by `Ingress` contracts, contains an `owner` field that is ass. The `ContractDetails` struct, utilized by `Ingress` contracts, contains an `owner` field that is assigned a value, but it is not utilized or accessed anywhere within the contract. This field is part of the `ContractDetails` struct, which is stored in a mapping called `registry`, where the key is a `...

Vulnerable code:
```\nstruct ContractDetails {\n    address owner;\n    address contractAddress;\n}\n\nmapping(bytes32 => ContractDetails) public registry;\n```
MEDIUM severity: The KeyManager ERC165 implementation does not properly support the LSP20 interface, which is a criti. The KeyManager ERC165 implementation does not properly support the LSP20 interface, which is a critical issue for clients that rely on verifying the support of LSP20 methods. Specifically, the `supportInterface()` function, which is responsible for determining whether the KeyManager supports a given...

Vulnerable code:
```\nfunction supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {\n    return interfaceId == _INTERFACEID_LSP6 || interfaceId == _INTERFACEID_ERC1271 ||\n        super.supportsInterface(interfaceId);\n}\n```
MEDIUM severity: The `Periphery#_swapPTsForTarget` function in the Periphery contract fails to correctly handle scena. The `Periphery#_swapPTsForTarget` function in the Periphery contract fails to correctly handle scenarios where the PT (Periphery Token) is mature but its redemption is restricted. This vulnerability arises from the fact that the function always attempts to redeem the PT, even when redemption is rest...

Vulnerable code:
```\nfunction _swapPTsForTarget(\n    address adapter,\n    uint256 maturity,\n    uint256 ptBal,\n    PermitData calldata permit\n) internal returns (uint256 tBal) {\n    _transferFrom(permit, divider.pt(adapter, maturity), ptBal);\n\n    if (divider.mscale(adapter, maturity) > 0) {\n        tBal = divider.redeem(adapter, maturity, ptBal);\n    } else {\n        tBal = _balancerSwap(\n            divider.pt(adapter, maturity),\n            Adapter(adapter).target(),\n            ptBal,\n            BalancerPool(spaceFactory.pools(adapter, maturity)).getPoolId(),\n            0,\n            payable(address(this))\n        );\n    }\n}\n```