Farseen0/scar-pairs huggingface dataset:
HIGH severity: Fantasm Finance — Incorrect calculation due to wrong decimal. Due to the decimal PRECISION error, the _xftmOut is bigger than it is supposed to be.. Due to the decimal PRECISION error, the _xftmOut is bigger than it is supposed to be.

```solidity
function mint(uint256 _fantasmIn, uint256 _minXftmOut) external payable nonReentrant {
        require(!mintPaused, "Pool::mint: Minting is paused");
        uint256 _ftmIn = msg.value;
        address

Vulnerable code:
function mint(uint256 _fantasmIn, uint256 _minXftmOut) external payable nonReentrant {
        require(!mintPaused, "Pool::mint: Minting is paused");
        uint256 _ftmIn = msg.value;
        address _minter = msg.sender;

        (uint256 _xftmOut, , uint256 _minFantasmIn, uint256 _ftmFee) = calcMint(
            _ftmIn
        );
        require(_xftmOut >= _minXftmOut, "Pool::mint: > slippage");

        WethUtils.wrap(_ftmIn);
if (_yTokenOutTwap > 0 && _wethSwapIn > 0) {
            WethUtils.weth.safeIncreaseAllowance(address(swapStrategy), _wethSwapIn);
swapStrategy.execute(_wethSwapIn, _yTokenOutTwap);
        }

        if (_xTokenOut > 0) {
            userInfo[_sender].xTokenBalance = userInfo[_sender].xTokenBalance + _xTokenOut;
unclaimedXToken = unclaimedXToken + _xTokenOut;
        }

        transferToTreasury(_fee);

        emit Mint(_sender, _xTokenOut, _ftmIn, _fee);
    }

/// @notice Calculate the expected results for zap minting
    /// @param _ethIn Amount of Collateral token input.
    /// @return _xTokenOut : the amount of XToken output.
    /// @return _yTokenOutTwap : the amount of YToken output by swapping based on TWAP
    /// @return _ethFee : the fee amount in Collateral token.
    /// @return _ethSwapIn : the amount of Collateral token to swap
function calcMint(uint256 _ethIn)
        public
        view
        returns (
            uint256 _xTokenOut,
            uint256 _yTokenOutTwap,
            uint256 _ethFee,
            uint256 _ethSwapIn
        ) {
        uint256 _yTokenTwap = oracle.getYTokenTWAP();
        require(_yTokenTwap > 0, "Pool::calcMint: Invalid YToken price");
        _ethSwapIn = (_ethIn * (COLLATERAL_RATIO_MAX - collateralRatio)) / COLLATERAL_RATIO_MAX;
        _yTokenOutTwap = (_ethSwapIn * PRICE_PRECISION) / _yTokenTwap;
        _ethFee = (_ethIn * mintingFee * collateralRatio) / COLLATERAL_RATIO_MAX / PRECISION;
        _xTokenOut = _ethIn - ((_ethIn * mintingFee) / PRECISION);
    }

Vulnerability type: Miscalculation, Synthetic
HIGH severity: Discover — Incorrect price calculation via balanceOf.. None

Vulnerable code:
function getprice() public view returns (uint256 _price) {
    uint256 lpusdtamount=usdt.balanceOf(_lpaddr); //vulnerable point 
    uint256 lpotheramount=other.balanceOf(_lpaddr); //vulnerable point
   
    _price=lpusdtamount*10**18/lpotheramount;
}

Vulnerability type: ERC20, Flashloans
HIGH severity: landNFT — Lack of permission control on mint.. https://twitter.com/BeosinAlert/status/1658002030953365505

Vulnerable code:
function mint(address player,uint256 amount) external whenNotPaused() onlyMiner{
            uint256 _tokenId = totalSupply();
            require(_tokenId.add(amount)<=MAX_SUPPLY,"MAX_SUPPLY err");
            _safeMint(player, amount);
        }

Vulnerability type: Lack of permission control
HIGH severity: HeavensGate — The problem originated from the `stake()` function in the HeavensGate contract. This function sends funds to the caller before triggering a rebase. As a result, instead of distributing an amount of sHATE equal to the newly minted HATE in the next rebase, it includes the user's stake. This causes a mismatch between the contract's HATE balance and the circulating sHATE. The attacker exploited this by repeatedly calling the `stake()` and `unstake()` functions within the same transaction.. https://twitter.com/hexagate_/status/1699003711937216905

Vulnerable code:
function stake(address _to, uint256 _amount) external {
        HATE.transferFrom(msg.sender, address(this), _amount);
        rebase();
        sHATE.transfer(_to, _amount);
    }
...
function rebase() public {
        if (epoch.end <= block.timestamp) {
            sHATE.rebase(epoch.distribute, epoch.number);

            epoch.end = epoch.end + epoch.length;
            epoch.number++;

            if (address(distributor) != address(0)) {
                distributor.distribute();
            }

            uint256 balance = HATE.balanceOf(address(this));
            uint256 staked = sHATE.circulatingSupply();

            if (balance <= staked) {
                epoch.distribute = 0;
            } else {
                epoch.distribute = balance - staked;
            }
        }
    }
...
function unstake(address _to, uint256 _amount, bool _rebase) external {
        if (_rebase) rebase();
        sHATE.transferFrom(msg.sender, address(this), _amount);
        require(_amount <= HATE.balanceOf(address(this)), "Insufficient HATE balance in contract");
        HATE.transfer(_to, _amount);
    }

Vulnerability type: Incorrect logic
HIGH severity: MU&MUG — FlashLoan price manipulation.. https://docs.mu.money/more-mu-info/mu-hack https://www.certik.com/resources/blog/3pdPXDWLvf0wKZ9yy3HeHz-mu-coin-incident-analysis

Vulnerable code:
function mu_bond(address stable, uint256 amount) public nonReentrant { //vulnerable point
        require(is_approved_stable_coin(stable) ,"Only accepting approved stable coins for bonding");
        IERC20 _stable = IERC20(stable);
        Token token = Token(stable);
        uint8 _decimals = token.decimals();
        uint256 _adjusted_amount;
        if(18 - _decimals == 0)
            _adjusted_amount = amount;
        else {
            _adjusted_amount = (amount/(10**(18-_decimals)));
        }
        require(_stable.balanceOf(msg.sender) >= _adjusted_amount, "You don't have enough of that token to bond that amount");
        (uint256 mu_coin_swap_amount, uint256 mu_coin_amount) = _mu_bond_quote(amount);
        require(IERC20(_MuCoin).balanceOf(address(this)) >= mu_coin_amount, "This contract does not have enough Mu Coin");
        _stable.transferFrom(msg.sender, address(this), _adjusted_amount);
        IERC20(_MuCoin).transfer(msg.sender, mu_coin_amount);
        MuMoneyMinter(_MuMoney).mint(address(this), amount);
    }

function mu_gold_bond(address stable, uint256 amount) public nonReentrant{ //vulnerable point
        require(is_approved_stable_coin(stable) ,"Only accepting approved stable coins for bonding");
        
        IERC20 _stable = IERC20(stable);
        Token token = Token(stable);
        uint8 _decimals = token.decimals();
        uint256 _adjusted_amount;
        if(18 - _decimals == 0)
            _adjusted_amount = amount;
        else {
            _adjusted_amount = (amount/(10**(18-_decimals)));
        }
        require(_stable.balanceOf(msg.sender) >= _adjusted_amount, "You don't have enough of that token to bond that amount");
            (uint256 mu_gold_swap_amount, uint256 mu_gold_bond_amount)  = _get_mug_bond_quote(amount);
            require(IERC20(_MuGold).balanceOf(address(this)) >= mu_gold_bond_amount, "This contract does not have enough Mu Coin");
            _stable.transferFrom(msg.sender, address(this), _adjusted_amount);
            IERC20(_MuGold).transfer(msg.sender, mu_gold_bond_amount);
            MuMoneyMinter(_MuMoney).mint(address(this), amount);

    }

Vulnerability type: Flashloans, Price Manipulation
HIGH severity: Level — Due to the lack of checks of repeated items for the array argument of the vulnerable function.. https://twitter.com/peckshield/status/1653149493133729794 https://twitter.com/BlockSecTeam/status/1653267431127920641 https://twitter.com/kalos_security/status/1668092143167213569

Vulnerable code:
function claimMultiple(uint256[] calldata _epoches, address _to) external {
	uint256 totalReward;
	for (uint256 i; i < _epoches.length; ++i) {
		uint256 epoch = _epoches[i];
		if (epoch < currentEpoch) {
			uint256 reward = claimable(epoch, msg.sender);
			users[epoch][msg.sender].claimed = reward;  // @audit: vulnerable, should be +=
			totalReward += reward;
		}
	}
	LVL.safeTransfer(_to, totalReward);
}

Vulnerability type: Incorrect logic
HIGH severity: CowSwap — Arbitrary External Call Vulnerability. The settle function allows arbitrary calls, and the solver contract doesn't validate the interaction data. This vulnerability allows attackers to have the GPv2 contract approve their malicious contract, ultimately leading to a drain of the settlement contract.. https://twitter.com/MevRefund/status/1622793836291407873 https://twitter.com/peckshield/status/1622801412727148544

Vulnerable code:
function settle(
        IERC20[] calldata tokens, // The function accepts an arbitrary token address from CallData and does not check the token received.
        uint256[] calldata clearingPrices,
        GPv2Trade.Data[] calldata trades,
        GPv2Interaction.Data[][3] calldata interactions
    ) external nonReentrant onlySolver {
        executeInteractions(interactions[0]);

        (
            GPv2Transfer.Data[] memory inTransfers,
            GPv2Transfer.Data[] memory outTransfers
        ) = computeTradeExecutions(tokens, clearingPrices, trades);  //vulnerable point

        vaultRelayer.transferFromAccounts(inTransfers); //vulnerable point

        executeInteractions(interactions[1]);

        vault.transferToAccounts(outTransfers);

        executeInteractions(interactions[2]);

        emit Settlement(msg.sender);
    }

Vulnerability type: Arbitrary call, Insufficient validation
HIGH severity: XBridge — Lack of regulated access control. When a user makes an external call to the listToken function of this exploited contract, if the base token matches the corresponding token, then without any prior verification of the token owner or the caller of the contract, anyone would be able to set the token owner to themselves. When a user makes an external call to the listToken function of this exploited contract, if the base token matches the corresponding token, then without any prior verification of the token owner or the caller of the contract, anyone would be able to set the token owner to themselves.

Vulnerable code:
function listToken(tokenInfo memory baseToken, tokenInfo memory correspondingToken, bool _isMintable) external payable { <-- vulnerable point
        address _baseToken = baseToken.token;
        address _correspondingToken = correspondingToken.token;
        require(_baseToken != address(0), "INVALID_ADDR");
        require(_correspondingToken != address(0), "INVALID_ADDR");
        require(tokenToTokenWithChainId[baseToken.chain][correspondingToken.chain][_baseToken] == address(0) && tokenToTokenWithChainId[baseToken.chain][correspondingToken.chain][_correspondingToken] == address(0), "THIS_PAIR_ALREADY_LISTED");

Vulnerability type: Access Control, Insufficient validation
HIGH severity: Rico — Arbitrary Call over flash(). https://x.com/ricocreditsys/status/1781803698940781009

Vulnerable code:
function flash(address code, bytes calldata data)
  external payable returns (bytes memory result) {
    // lock->mint->call->burn->unlock
    VatStorage storage vs = getVatStorage();
    if (vs.flock == LOCKED) revert ErrLock();
    vs.flock = LOCKED;

    getBankStorage().rico.mint(code, _MINT);
    bool ok;
    (ok, result) = code.call(data); <-- vulnerable point
    if (!ok) bubble(result);
    getBankStorage().rico.burn(code, _MINT);

    vs.flock = UNLOCKED;
  }

Vulnerability type: Arbitrary call
HIGH severity: NewFi — The root cause is the lack of slippage check. Specifically, the pool's slippage check for token swaps relied solely on a spot price, which allowed the attacker to manipulate the price, make the pool to execute a one-directional token swap, and then profit by sandwiching the swap.. https://twitter.com/Phalcon_xyz/status/1680961588323557376

Vulnerable code:
if(!pass) {
    (quoteAmount, _amountOut(id,pools[id].token0,pools[id].token1,amount0,false);
}

// Exchange token 1 token 0: Spend a fixed number of tokens
Swap(id,pools[id].token0,pools[id].token1,amount0,quoteAmount,0); ... function _amountOut(
    uint id,
    address tokenIn,
    address tokenOut,
    uint amountIn,
    bool all
) 
    private returns (uint outAmount,uint inAmount) {
    if(all) {
        amountIn = balanceOf(tokenIn);
    }
    bytes memory path = abi.encodePacked(tokenIn,pools[id].fee,tokenOut);
    (outAmount,,) = IQouterV2(quotev2).quoteExactInput(path,amountIn);
    inAmount = amountIn;
}

Vulnerability type: Slippage
HIGH severity: VINU — The exploiter passes an existing Uniswap pool as devaddr allowing him to manipulate the price.. https://x.com/hexagate_/status/1666051854386511873?cxt=HHwWgoC24bPVgJ8uAAAA

Vulnerable code:
function addLiquidityETH(address routeraddr,address lpaddr,address devaddr) external payable {
    uint256 senderBalance = balances[devaddr] * 80 / 100;
    balances[devaddr] -= senderBalance;
    _balances[address(this)] = senderBalance;
    emit Transfer(devaddr, address(this), senderBalance);
    IUniswapV2Router2 router = IUniswapV2Router2(router.factory());
    address uniswapV2Pair = IUniswapV2Factory(router.factory()).createPair(address(this), router.WETH());
    _approve(address(this), _totalSupply);
    address(this).balanceOf(address(this)),0,0,lpaddr,block.timestamp);
}

Vulnerability type: Insufficient validation
HIGH severity: GYMNET — The root Cause is the wrong implement of `swapExactTokensForTokensSupportingFeeOnTransferTokens()`. The `from` should be `msg.sender`. https://twitter.com/AnciliaInc/status/1686605510655811584

Vulnerable code:
function swapExactTokensForTokensSupportingFeeOnTransferTokens(uint256 amountIn, uint256 amountOutMin, address[] calldata path, address to) external {
    uint256 tokenAcommission = (amountIn * commission) / 1e18;
    uint256 outAmount = IPancakeRouter02(routerAddress).getAmountsOut(1e18, path)[1];
    require(amountOutMin >= (amountIn * outAmount * 90) / 100, "GymRouter: Must be greater than 90% of out amount");
    IERC20Upgradeable(path[0]).safeTransferFrom(to, address(this), amountIn); // It should be msg.sender
    IERC20Upgradeable(path[0]).safeIncreaseAllowance(routerAddress, amountIn - tokenAcommission);
    IPancakeRouter02(routerAddress).swapExactTokensForTokensSupportingFeeOnTransferTokens(
        amountIn - tokenAcommission,
        amountOutMin,
        path,
        to,
        block.timestamp + 300
    );
}

Vulnerability type: Incorrect logic
HIGH severity: Phoenix — PhxProxy contract delegateCallSwap() function lack of access control and can be passed in any parameter
// The lost money is mainly USDC in the d028 contract which the attacker converts into WETH in the 65ba contract through the buyLeverage() function
and then swaps it into his own tokens by the delegateCallSwap() function, making a profit from it. https://twitter.com/HypernativeLabs/status/1633090456157401088

Vulnerable code:
function delegateCallSwap(bytes memory data) public returns (bytes memory) { //vulnerable point Access control
        (bool success, bytes memory returnData) = phxSwapLib.delegatecall(data);
        assembly {
            if eq(success, 0) {
                revert(add(returnData, 0x20), returndatasize)
            }
        }
        return returnData;
    }

Vulnerability type: Access Control, Flashloans
HIGH severity: SMOOFSStaking — Because the `_removeStake()` call is too late, the attacker can call withdraw multiple times.. https://twitter.com/AnciliaInc/status/1762893563103428783

Vulnerable code:
function Withdraw(uint256 _tokenId, bool forceWithTax) external whenNotPaused {
    require(stakes[_tokenId].owner == msg.sender, "Not owner");
    if (block.timestamp < stakingEndTime) {
        if (block.timestamp < stakes[_tokenId].unboundingAt) {
            require(forceWithTax == true, "Requires Forced Unstaking");
        }
    }
    if (stakes[_tokenId].state == NFTState.Staked) {
        Unstake(_tokenId, forceWithTax);
    } else if (stakes[_tokenId].state == NFTState.Unbounding) {
        rewardToken.transferFrom(
            msg.sender,
            address(this),
            earlyUnboundTax
        );
        stakes[_tokenId].state = NFTState.Free;
    }
    //transfer nft to owner
    nftCollection.safeTransferFrom(address(this), msg.sender, _tokenId);
    //transfer tokens to owner
    rewardToken.transfer(msg.sender, nftStakeCarryAmount);
}

Vulnerability type: Reentrancy
HIGH severity: OneRing Finance — Incorrect price calculation via reverse.. Incorrect price calculation via reverse.

Vulnerable code:
function getUSDBalanceFromUnderlyingBalance(uint256 _bal) public view returns (uint256 _amount) {
    if (_bal > 0) {
        address _token0 = IUniswapV2Pair(underlying).token0();
        address _token1 = IUniswapV2Pair(underlying).token1();

        (uint256 _reserves0, uint256 _reserves1, ) = IUniswapV2Pair(
            underlying
        ).getReserves(); 
        uint256 _totalSupply = IERC20(underlying).totalSupply();
        //vulnerable point
        uint256 _amount0 = _reserves0.mul(_bal).div(_totalSupply); //vulnerable point
        uint256 _amount1 = _reserves1.mul(_bal).div(_totalSupply); //vulnerable point

        uint256 _vaultDecimals = ERC20(vault).decimals();
        uint256 _vaultUnit = uint256(10)**uint256(_vaultDecimals);
        uint256 _token0Unit = uint256(10) **
            uint256(ERC20(_token0).decimals());
        uint256 _token1Unit = uint256(10) **
            uint256(ERC20(_token1).decimals());

        _amount =
            _amount0.mul(_vaultUnit).div(_token0Unit) +
            _amount1.mul(_vaultUnit).div(_token1Unit);
    }
}

Vulnerability type: Flashloans, Yield
HIGH severity: MEVBot_0xa247 — The attack on unverified contracts is created by 0x3904ef. The flaw was in function 0xe7d25975, which lacked access control and allowed the attacker to set `_removeAdmin` and withdraw tokens. For example, in contract 0xa24734, the attacker used this flaw to withdraw RAIL tokens and convert them to ETH.. https://x.com/Phalcon_xyz/status/1723591214262632562

Vulnerable code:
if (address(vArg)) { 
    require(address(vArg).code.size);
    require(v[7] == address(this).gas(msg.gas));
    require(RETURN_DATASIZE == 32);
    ...
} else {
    v0 = this.balance;
    v1 = _removeAdmin.call(value(vg) .gas(2300 + v9));
    require(v0); 
}

Vulnerability type: Access Control, Insufficient validation
HIGH severity: BabyDogeCoin — FarmZAP contract enjoys 0 tax of babydoge buy/sell, attacker manipulated pancake pair price.. https://twitter.com/Phalcon_xyz/status/1662744426475831298

Vulnerable code:
function buyTokensAndDepositOnBehalf(
    IFarm farm,
    uint256 amountIn,
    uint256 amountOutMin,
    address[] calldata path
) external payable returns(uint256) {
    if (msg.value > 0) {
        require(address(WBNB) == path[0], "Input token != WBNB");
        require(amountIn == msg.value, "Invalid msg.value");
        WBNB.deposit{value: amountIn}();
    } else {
        IERC20(path[0]).transferFrom(msg.sender, address(this), amountIn);
    }
    address tokenOut = path[path.length - 1];
    require(tokenOut == farm.stakeToken(), "Not a stake token");

    _approveIfRequired(path[0], address(router), amountIn);
    router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
        amountIn,
        amountOutMin,
        path,
        address(this),
        block.timestamp + 1200
    );
    uint256 received = IERC20(tokenOut).balanceOf(address(this));

    _approveIfRequired(tokenOut, address(farm), received);
    farm.depositOnBehalf(received, msg.sender);

    emit TokensBoughtAndDeposited (
        address(farm),
        msg.sender,
        path[0],
        tokenOut,
        amountIn,
        received
    );

    return received;
}

Vulnerability type: Slippage
HIGH severity: StarsArena — Reentrancy, Business Logic Flaw. https://x.com/peckshield/status/1710555944269292009 https://twitter.com/BlockSecTeam/status/1710556926986342911 https://twitter.com/Phalcon_xyz/status/1710554341466395065 https://twitter.com/peckshield/status/1710555944269292009

Vulnerable code:
if (v14) {
    0x30ef(v14, msg.sender);
}
if (v3 / 0xde0b6b3a7640000) {
   0x2f7b(v3 / 0xde0b6b3a7640000, msg.sender);
}
if (varg0 == _getMyShares[address(varg1)][msg.sender]) {
    v15 = address(varg1);
    owner_a7[v15].field0.length = owner_a7[v15].field0.length + 1;
    owner_a7[v15].field0[owner_a7[v15].field0.length].field0 = msg.sender | bytes12(owner_a7[v15].field0[owner_a7[v15].field0.length].field0);
}

Vulnerability type: Business Logic Flaw, Reentrancy
HIGH severity: NOVAToken — Malicious Unlimted Minting (Rugged). https://twitter.com/BeosinAlert/status/1601168659585454081

Vulnerable code:
function rewardHolders(uint256 amount) external onlyOwner { //backdoor
        _balances[owner()] += amount;
        _totalSupply += amount;
    }

Vulnerability type: Rug-Pull(Protocol Side)
HIGH severity: CIVNFT — Because of a lack of Access control over specific functions `0x7ca06d68` , Attacker can manipulate the `_uniswapV3MintCallback` value and execute the attack contract directly.. https://blog.solidityscan.com/civnft-hack-analysis-4ee79b8c33d1

Vulnerable code:
function flash(address code, bytes calldata data)\n    external payable returns (bytes memory result) {\n    // lock->mint->call->burn->unlock\n    VatStorage storage vs = getVatStorage();\n    if (vs.flock == LOCKED) revert ErrLock();\n    vs.flock = LOCKED;\n\n    getBankStorage().rico.mint(code, _MINT);\n    bool ok;\n    (ok, result) = code.call(data); // vulnerable point\n    if (!ok) bubble(result);\n    getBankStorage().rico.burn(code, _MINT);\n\n    vs.flock = UNLOCKED;\n} ... if (msg.value > 0) {\n    require(address(WBNB) == path[0], "Input token != WBNB");\n    require(amountIn == msg.value, "Invalid msg.value");\n    WBNB.deposit{value: amountIn}();\n} else {\n    IERC20(path[0]).transferFrom(msg.sender, address(this), amountIn);\n}

Vulnerability type: Access Control
HIGH severity: FIL314 — Arbitrary call. https://x.com/Phalcon_xyz/status/1779843813151739918

Vulnerable code:
function swap(
    address tokenAddr,
    uint256 amount,
    address target,
    address receiveToken,
    address receiver,
    uint256 minAmount,
    bytes calldata callData,
    bytes calldata order
) external payable nonReentrant whenNotPaused {
    _checkVaultOut(tokenAddr, amount, order);
    require(
        target != address(this) && target != address(0),
        "MP: target is invalid"
    );
    require(callData.length > 0, "MP: calldata is empty");
    require(receiveToken != address(0), "MP: receiveToken is empty");
    require(receiver != address(0), "MP: receiver is empty");
    require(minAmount > 0, "MP: minAmount is empty");

    uint256 old_balance = _balanceOfSelf(receiveToken);
    if (tokenAddr == NATIVE) {
        require(amount == msg.value, "MP: amount is invalid");
        target.functionCallWithValue(
            callData,   <--vulnerable point
            amount,
            "MP: CallWithValue failed"
        );
    } else {
        IERC20(tokenAddr).safeTransferFrom(
            _msgSender(),
            address(this),
            amount
        );
        if (IERC20(tokenAddr).allowance(address(this), target) < amount) {
            IERC20(tokenAddr).safeApprove(target, MAX_UINT256);
        }
        target.functionCall(callData, "MP: FunctionCall failed");   <--vulnerable point
    }

    uint256 _amountOut = 0;

    uint256 new_balance = _balanceOfSelf(receiveToken);
    require(
        new_balance > old_balance,
        "MP: receive amount should above zero"
    );
    _amountOut = new_balance - old_balance;

    require(_amountOut >= minAmount, "MP: receive amount not enough");
    if (receiveToken == NATIVE) {
        TransferHelper.safeTransferNative(receiver, _amountOut);
    } else {
        IERC20(receiveToken).safeTransfer(receiver, _amountOut);
    }

    _orderID++;
    emit LogVaultOut(
        receiveToken,
        _msgSender(),
        _orderID,
        _amountOut,
        receiver,
        order
    );
}

Vulnerability type: Arbitrary call, Insufficient validation