Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: The vulnerability arises when there is a discrepancy between the global and local positions due to i. The vulnerability arises when there is a discrepancy between the global and local positions due to invalid oracle versions. This can occur when there are pending positions with timestamps differing by two oracle versions, and the first position has an invalid oracle version at its timestamp. This ca...

Vulnerable code:
```\nit('panprog global-local desync', async () => {\n    const positionMaker = parse6decimal('2.000');\n    const positionLong = parse6decimal('1.000');\n    const collateral = parse6decimal('100');\n\n    const oracleVersion = {\n        price: parse6decimal('100'),\n        timestamp: TIMESTAMP,\n        valid: true,\n    };\n    oracle.at.whenCalledWith(oracleVersion.timestamp).returns(oracleVersion);\n    oracle.status.returns([oracleVersion, oracleVersion.timestamp + 100]);\n    oracle.request.returns();\n\n    dsu.transferFrom.whenCalledWith(userB.address, market.address, collateral.mul(1e12)).returns(true);\n    await market.connect(userB).update(userB.address, positionMaker, 0, 0, collateral, false);\n\n    const oracleVersion2 = {\n        price: parse6decimal('100'),\n        timestamp: TIMESTAMP + 100,\n        valid: true,\n    };\n    oracle.at.whenCalledWith(oracleVersion2.timestamp).returns(oracleVersion2);\n    oracle.status.returns([oracleVersion2, oracleVersion2.timestamp + 100]);\n    oracle.request.returns();\n\n    dsu.transferFrom.whenCalledWith(user.address, market.address, collateral.mul(1e12)).returns(true);\n    await market.connect(user).update(user.address, 0, positionLong, 0, collateral, false);\n\n    const info = await market.locals(userB.address);\n    console.log("collateral deposit maker: " + info.collateral);\n    const info2 = await market.locals(user.address);\n    console.log("collateral deposit long: " + info2.collateral);\n\n    const oracleVersion3 = {\n        price: 0,\n        timestamp: TIMESTAMP + 200,\n        valid: false,\n    };\n    oracle.at.whenCalledWith(oracleVersion3.timestamp).returns(oracleVersion3);\n\n    const oracleVersion4 = {\n        price: parse6decimal('100'),\n        timestamp: TIMESTAMP + 300,\n        valid: true,\n    };\n    oracle.at.whenCalledWith(oracleVersion4.timestamp).returns(oracleVersion4);\n\n    oracle.status.returns([oracleVersion2, oracleVersion4.timestamp + 100]);\n    oracle.request.returns();\n\n    await market.connect(user).update(user.address, 0, 0, 0, 0, false);\n\n    oracle.status.returns([oracleVersion4, oracleVersion4.timestamp + 100]);\n    oracle.request.returns();\n\n    await market.connect(userB).update\n```\n```\ncollateral_deposit_maker: 100000000\ncollateral_deposit_long: 100000000\ncollateral_maker: 110000028\ncollateral_long: 100000000\n```
MEDIUM severity: The `withdraw()` function of the SingleSidedLiquidityVault contract contains a calculation error in . The `withdraw()` function of the SingleSidedLiquidityVault contract contains a calculation error in the `_withdrawUpdateRewardState()` function. This error allows users to receive more rewards than they are supposed to, as a result of a mistake in the reward state update.\n\nWhen a user withdraws th...

Vulnerable code:
```\nfunction _withdrawUpdateRewardState(uint256 lpAmount_, bool claim_) internal {\n    uint256 numInternalRewardTokens = internalRewardTokens.length;\n    uint256 numExternalRewardTokens = externalRewardTokens.length;\n\n    uint256[] memory accumulatedInternalRewards = _accumulateInternalRewards();\n    uint256[] memory accumulatedExternalRewards = _accumulateExternalRewards();\n\n    for (uint256 i = 0; i < numInternalRewardTokens; i++) {\n        _updateInternalRewardState(i, accumulatedInternalRewards[i]);\n        if (claim_) _claimInternalRewards(i);\n\n        InternalRewardToken memory rewardToken = internalRewardTokens[i];\n        uint256 rewardDebtDiff = lpAmount_ * rewardToken.accumulatedRewardsPerShare;\n\n        if (rewardDebtDiff > userRewardDebts[msg.sender][rewardToken.token]) {\n            userRewardDebts[msg.sender][rewardToken.token] = 0;\n            cachedUserRewards[msg.sender][rewardToken.token] += rewardDebtDiff - userRewardDebts[msg.sender][rewardToken.token];\n        } else {\n            userRewardDebts[msg.sender][rewardToken.token] -= rewardDebtDiff;\n        }\n    }\n```
MEDIUM severity: The `PaymentExitGame` contract inherits from both `PaymentInFlightExitRouter` and `PaymentStandardEx. The `PaymentExitGame` contract inherits from both `PaymentInFlightExitRouter` and `PaymentStandardExitRouter`, which is a common practice in object-oriented programming. However, a closer examination of the code reveals that each of these contracts declares and initializes its own `PlasmaFramework`...

Vulnerable code:
```\nprivate plasmaFramework;\n```\n```\nPlasmaFramework private framework;\n```\n```\nPlasmaFramework private framework;\n```
MEDIUM severity: The `setMintCap` function in the `Dram` stable coin's approval-like model is susceptible to front-ru. The `setMintCap` function in the `Dram` stable coin's approval-like model is susceptible to front-running attacks. This vulnerability arises from the direct manipulation of the minting caps by operators, allowing them to exploit the approval mechanism. Specifically, an attacker can front-run a trans...

Vulnerable code:
```\nfunction setMintCap(\n    address operator,\n    uint256 amount\n) external onlyRoleOrAdmin(ROLE_MANAGER_ROLE) {\n    _setMintCap(operator, amount);\n}\n```
MEDIUM severity: The WAuraPools contract is vulnerable to an out-of-bounds (OOB) error when attempting to add a new r. The WAuraPools contract is vulnerable to an out-of-bounds (OOB) error when attempting to add a new reward token to the pool after a deposit has been made. This occurs due to the `accExtPerShare` array not being updated to accommodate the new reward token, resulting in an OOB error when attempting to...

Vulnerable code:
```\nuint extraRewardsCount = IAuraRewarder(crvRewarder).extraRewardsLength();\n\ntokens = new address[](extraRewardsCount + 1);\nrewards = new uint256[](extraRewardsCount + 1);\n\ntokens[0] = IAuraRewarder(crvRewarder).rewardToken();\nrewards[0] = _getPendingReward(\n    stCrvPerShare,\n    crvRewarder,\n    amount,\n    lpDecimals\n);\n\nfor (uint i = 0; i < extraRewardsCount; i++) {\n    address rewarder = IAuraRewarder(crvRewarder).extraRewards(i);\n\n    uint256 stRewardPerShare = accExtPerShare[tokenId][i];\n    tokens[i + 1] = IAuraRewarder(rewarder).rewardToken();\n    rewards[i + 1] = _getPendingReward(\n        stRewardPerShare,\n        rewarder,\n        amount,\n        lpDecimals\n    );\n}\n```
MEDIUM severity: The vulnerability arises when the vault's side token balance is extremely low or zero, which can occ. The vulnerability arises when the vault's side token balance is extremely low or zero, which can occur when the current price trades above the high boundary (Kb) and the IG Bull used liquidity equals zero. In this scenario, the delta hedge amount calculation in `FinanceIGDelta.deltaHedgeAmount` fail...

Vulnerable code:
```\nif (SignedMath.abs(tokensToSwap) > params.sideTokensAmount):\n    if (SignedMath.abs(tokensToSwap) - params.sideTokensAmount < params.sideTokensAmount / 10000):\n        tokensToSwap = SignedMath.revabs(params.sideTokensAmount, True)\n```
MEDIUM severity: The `ExternalLending` vulnerability occurs when the Treasury rebalances and attempts to redeem aToke. The `ExternalLending` vulnerability occurs when the Treasury rebalances and attempts to redeem aTokens from AaveV3, failing to account for transfer fees associated with fee-on-transfer tokens. Specifically, the `withdrawAmount` variable does not consider the transfer fee, which is deducted from the...

Vulnerable code:
```\naddress[] memory targets = new address[](UNDERLYING_IS_ETH? 2 : 1);\nbytes[] memory callData = new bytes[](UNDERLYING_IS_ETH? 2 : 1);\ntargets[0] = LENDING_POOL;\ncallData[0] = abi.encodeWithSelector(\n    ILendingPool.withdraw.selector, \n    underlyingToken, \n    withdrawAmount, \n    address(NOTIONAL)\n);\n\nif (UNDERLYING_IS_ETH) {\n    targets[1] = address(Deployments.WETH);\n    callData[1] = abi.encodeWithSelector(WETH9.withdraw.selector, withdrawAmount);\n}\n\ndata = new RedeemData[](1);\nuint8 rebasingTokenBalanceAdjustment = UNDERLYING_DECIMALS <= 8? 1 : 0;\ndata[0] = RedeemData(\n    targets, \n    callData, \n    withdrawAmount, \n    ASSET_TOKEN, \n    rebasingTokenBalanceAdjustment\n);\n```\n```\nfor (uint256 j; j < data.targets.length; j++) {\n    GenericToken.executeLowLevelCall(data.targets[j], 0, data.callData[j]);\n}\n\n// Ensure that we get sufficient underlying on every redemption\nuint256 newUnderlyingBalance = TokenHandler.balanceOf(underlyingToken, address(this));\nuint256 underlyingBalanceChange = newUnderlyingBalance.sub(oldUnderlyingBalance);\n\nrequire(underlyingBalanceChange >= data.expectedUnderlying);\n```\n```\nredeemAmounts[0] = currentAmount - targetAmount\n```
MEDIUM severity: The `MultiInvoker` contract's `_latest` function calculates the `closable` amount incorrectly due to. The `MultiInvoker` contract's `_latest` function calculates the `closable` amount incorrectly due to the incorrect initialization of `closableAmount`. Specifically, it does not initialize `closableAmount` before scanning pending positions, resulting in its default value of 0. This issue arises when...

Vulnerable code:
```\nfunction _latest(\n    IMarket market,\n    address account\n) internal view returns (Position memory latestPosition, Fixed6 latestPrice, UFixed6 closableAmount) {\n    IPayoffProvider payoff = market.payoff();\n\n    uint256 latestTimestamp = market.oracle().latest().timestamp;\n    latestPosition = market.positions(account);\n    latestPrice = market.global().latestPrice;\n    UFixed6 previousMagnitude = latestPosition.magnitude();\n\n    // scan pending position for any ready-to-be-settled positions\n    Local memory local = market.locals(account);\n    for (uint256 id = local.latestId + 1; id <= local.currentId; id++) {\n        Position memory pendingPosition = market.pendingPositions(account, id);\n        pendingPosition.adjust(latestPosition);\n\n        OracleVersion memory oracleVersion = market.oracle().at(pendingPosition.timestamp);\n        if (address(payoff)!= address(0)) oracleVersion.price = payoff.payoff(oracleVersion.price);\n\n        if (pendingPosition.timestamp <= latestTimestamp) {\n            if (!oracleVersion.valid) latestPosition.invalidate(pendingPosition);\n            latestPosition.update(pendingPosition);\n            if (oracleVersion.valid) latestPrice = oracleVersion.price;\n\n            previousMagnitude = latestPosition.magnitude();\n            closableAmount = previousMagnitude;\n        } else {\n            closableAmount = closableAmount.sub(previousMagnitude.sub(pendingPosition.magnitude().min(previousMagnitude)));\n            previousMagnitude = latestPosition.magnitude();\n        }\n    }\n}\n```\n```\nmarket.update(\n    account,\n    currentPosition.maker.isZero()? UFixed6Lib.ZERO : currentPosition.maker.sub(closable),\n    currentPosition.long.isZero()? UFixed6Lib.ZERO : currentPosition.long.sub(closable),\n    currentPosition.short.isZero()? UFixed6Lib.ZERO : currentPosition.short.sub(closable),\n    Fixed6Lib.from(-1, liquidationFee),\n    true\n);\n```\n```\nif (protected && (\n   !closableAmount.isZero() ||\n    context.latestPosition.local.maintained(\n        context.latestVersion,\n        context.riskParameter,\n        collateralAfterFees.sub(collateral)\n    ) ||\n    collateral.lt(Fixed6Lib.from(-1, _liquidationFee(context, newOrder)))\n)) {\n    revert MarketInvalidProtectionError();\n}\n```
MEDIUM severity: The `TokenStaking` contract in the Keep protocol is designed to penalize stakers who violate the pro. The `TokenStaking` contract in the Keep protocol is designed to penalize stakers who violate the protocol's rules by slashing their stakes. This is achieved through the `slash()` function, which is intended to be called when a staker's behavior is deemed misbehaving. The function takes two parameter...

Vulnerable code:
```\n/**\n * @dev Slash provided token amount from every member in the misbehaved operators array and burn 100% of all the tokens.\n * @param amount Token amount to slash from every misbehaved operator.\n * @param misbehavedOperators Array of addresses to seize the tokens from.\n */\nfunction slash(uint256 amount, address[] memory misbehavedOperators)\n    public\n    onlyApprovedOperatorContract(msg.sender) {\n    for (uint i = 0; i < misbehavedOperators.length; i++) {\n        address operator = misbehavedOperators[i];\n        require(authorizations[msg.sender][operator], "Not authorized");\n        operators[operator].amount = operators[operator].amount.sub(amount);\n    }\n\n    token.burn(misbehavedOperators.length.mul(amount));\n}\n```
MEDIUM severity: The ConvexSpell contract's `openPositionFarm` function is vulnerable to a compatibility issue when i. The ConvexSpell contract's `openPositionFarm` function is vulnerable to a compatibility issue when interacting with Curve pools that utilize native ETH. The function attempts to call the `balanceOf` method on each component of the LP, which is a standard ERC20-compliant function. However, native ETH...

Vulnerable code:
```\nif (tokens.length == 2) {\n    uint256[2] memory suppliedAmts;\n    for (uint256 i = 0; i < 2; ++i) {\n        suppliedAmts[i] = IERC20Upgradeable(tokens[i]).balanceOf(address(this));\n    }\n    ICurvePool(pool).add_liquidity(suppliedAmts, minLPMint);\n```
MEDIUM severity: The vulnerability in the RocketVault system lies in its handling of zero-amount token transfers. Spe. The vulnerability in the RocketVault system lies in its handling of zero-amount token transfers. Specifically, the system allows for zero-amount deposits, withdrawals, and transfers of tokens, which can potentially lead to reentrancy attacks and unauthorized access to the system.\n\nIn the `depositE...

Vulnerable code:
```\nfunction depositEther() override external payable onlyLatestNetworkContract {\n    bytes32 contractKey = keccak256(abi.encodePacked(getContractName(msg.sender)));\n    etherBalances[contractKey] = etherBalances[contractKey].add(msg.value);\n    emit EtherDeposited(contractKey, msg.value, block.timestamp);\n}\n```
MEDIUM severity: The `Perpetual` contract allows administrators to put the system into emergency mode indefinitely, e. The `Perpetual` contract allows administrators to put the system into emergency mode indefinitely, effectively locking out users from trading or withdrawing funds. This vulnerability arises from the lack of a time limit on the duration of the emergency mode. Once an administrator initiates the emerg...

Vulnerable code:
```\nfunction beginGlobalSettlement(uint256 price) public onlyWhitelistAdmin {\n    require(status!= LibTypes.Status.SETTLED, "already settled");\n    settlementPrice = price;\n    status = LibTypes.Status.SETTLING;\n    emit BeginGlobalSettlement(price);\n}\n```\n```\nfunction endGlobalSettlement() public onlyWhitelistAdmin {\n    require(status == LibTypes.Status.SETTLING, "wrong perpetual status");\n\n    address guy = address(amm.perpetualProxy());\n    settleFor(guy);\n    status = LibTypes.Status.SETTLED;\n\n    emit EndGlobalSettlement();\n}\n```
MEDIUM severity: The Keeper design complexity vulnerability highlights the intricate and critical nature of the keepe. The Keeper design complexity vulnerability highlights the intricate and critical nature of the keeper's off-chain logic in maintaining the integrity of the vault's operations. The complexity arises from the need to execute specific orders of operations, ensuring that the vault's funds and shares are...

Vulnerable code:
```\nshares = totalSupply() > 0\n   ? (totalSupply() * amountIn) / totalVaultFunds()\n    : amountIn;\n```\n```\nfunction totalVaultFunds() public view returns (uint256) {\n    return IERC20(wantToken).balanceOf(address(this)) + totalExecutorFunds();\n}\n```\n```\nfunction totalFunds() public view override returns (uint256, uint256) {\n    return ConvexPositionHandler.positionInWantToken();\n}\n```\n```\nfunction positionInWantToken()\n    public\n    override\n    returns (uint256, uint256)\n{\n    (\n        uint256 stakedLpBalanceInETH,\n        uint256 lpBalanceInETH,\n        uint256 ethBalance\n    ) = _getTotalBalancesInETH(true);\n\n    return (\n        stakedLpBalanceInETH + lpBalanceInETH + ethBalance,\n        block.number\n    );\n}\n```\n```\nfunction totalFunds()\n    public\n    view\n    override\n    returns (uint256 posValue, uint256 lastUpdatedBlock)\n{\n    return (\n        positionInWantToken.posValue +\n        IERC20(vaultWantToken()).balanceOf(address(this))\n    );\n}\n```\n```\nfunction setPosValue(uint256 _posValue) public onlyKeeper {\n    LyraPositionHandler._setPosValue(_posValue);\n}\n```\n```\nfunction _setPosValue(uint256 _posValue) internal {\n    positionInWantToken.posValue = _posValue;\n    positionInWantToken.lastUpdatedBlock = block.number;\n}\n```
MEDIUM severity: The validation of Merkle proofs in the provided code appears to be susceptible to an unbounded loop,. The validation of Merkle proofs in the provided code appears to be susceptible to an unbounded loop, which could potentially lead to denial-of-service (DoS) attacks. The loop iterates over the `_operatorData` array, processing 32-byte chunks at a time, and populating a `bytes32[]` array called `proo...

Vulnerable code:
```\nuint256 proofNb = (_operatorData.length - 84) / 32;\nbytes32[] memory proof = new bytes32[](proofNb);\nuint256 index = 0;\nfor (uint256 i = 116; i <= _operatorData.length; i = i + 32) {\n    bytes32 temp;\n    assembly {\n        temp := mload(add(_operatorData, i))\n    }\n    proof[index] = temp;\n    index++;\n}\n```
MEDIUM severity: This vulnerability arises from an assumption made about the distribution of interest, which may not . This vulnerability arises from an assumption made about the distribution of interest, which may not accurately reflect real-world scenarios. The code relies on the extrapolation of APY (Annual Percentage Yield) to determine whether interest should be collected. However, this extrapolation is based o...

Vulnerable code:
```\nrequire extrapolatedAPY < MAX_APY, "Interest protected from inflating past maxAPY"\n```
MEDIUM severity: The vulnerability lies in the `MarginCallPrimaryFacet._canLiquidate` function, specifically in the c. The vulnerability lies in the `MarginCallPrimaryFacet._canLiquidate` function, specifically in the condition `if (timeDiff >= resetLiquidationTime)`. This check prevents shorts flagged for liquidation from being liquidated in the last hour of the liquidation timeline, resulting in the liquidation fl...

Vulnerable code:
```\nfunction _canLiquidate(MTypes.MarginCallPrimary memory m)\n    private\n    view\n    returns (bool)\n{\n    uint256 timeDiff = LibOrders.getOffsetTimeHours() - m.short.updatedAt;\n    uint256 resetLiquidationTime = LibAsset.resetLiquidationTime(m.asset);\n\n    if (timeDiff >= resetLiquidationTime) {\n        return false;\n    } else {\n        uint256 secondLiquidationTime = LibAsset.secondLiquidationTime(m.asset);\n        bool isBetweenFirstAndSecondLiquidationTime = \n            timeDiff > LibAsset.firstLiquidationTime(m.asset) \n            && timeDiff <= secondLiquidationTime \n            && s.flagMapping[m.short.flaggerId] == msg.sender;\n        bool isBetweenSecondAndResetLiquidationTime = \n            timeDiff > secondLiquidationTime \n            && timeDiff <= resetLiquidationTime;\n\n        if (\n           !(\n                (isBetweenFirstAndSecondLiquidationTime) \n                    || (isBetweenSecondAndResetLiquidationTime)\n            )\n        ) {\n            revert Errors.MarginCallIneligibleWindow();\n        }\n        return true;\n    }\n}\n```\n```\nif (timeDiff <= resetLiquidationTime) {\n    Errors.MarginCallAlreadyFlagged();\n}\n```
MEDIUM severity: The `JUSDBankStorage` contract contains two functions, `accrueRate()` and `getTRate()`, which are re. The `JUSDBankStorage` contract contains two functions, `accrueRate()` and `getTRate()`, which are responsible for calculating the time-weighted rate (tRate) and returning it. However, these functions are calculated differently, leading to biased data calculations.\n\nThe `accrueRate()` function upda...

Vulnerable code:
```\nfunction accrueRate() public {\n    uint256 currentTimestamp = block.timestamp;\n    if (currentTimestamp == lastUpdateTimestamp) {\n        return;\n    }\n    uint256 timeDifference = block.timestamp - uint256(lastUpdateTimestamp);\n    tRate = tRate.decimalMul((timeDifference * borrowFeeRate) / Types.SECONDS_PER_YEAR + 1e18);\n    lastUpdateTimestamp = currentTimestamp;\n}\n\nfunction getTRate() public view returns (uint256) {\n    uint256 timeDifference = block.timestamp - uint256(lastUpdateTimestamp);\n    return tRate + (borrowFeeRate * timeDifference) / Types.SECONDS_PER_YEAR;\n}\n```
MEDIUM severity: The `PorticoFinish::payOut` function at line 376 attempts to calculate the final user amount by subt. The `PorticoFinish::payOut` function at line 376 attempts to calculate the final user amount by subtracting the `relayerFeeAmount` from the final post-bridge and post-swap token balance. However, this calculation is vulnerable to underflow and can result in the bridged tokens being stuck due to the...

Vulnerable code:
```\nfinalUserAmount = finalToken.balanceOf(address(this)) - relayerFeeAmount\n```
MEDIUM severity: The `beforePayment()` function in the Public Vault's code lacks an essential update to the `yInterce. The `beforePayment()` function in the Public Vault's code lacks an essential update to the `yIntercept` variable, which can lead to the vault becoming insolvent. `yIntercept` is a critical component in calculating the total assets of the public vault, as it represents the sum of all LienToken amount...

Vulnerable code:
```\n/**\n * @notice Hook to update the slope and yIntercept of the PublicVault on payment.\n * The rate for the LienToken is subtracted from the total slope of the PublicVault, and recalculated in afterPayment().\n * @param lienId The ID of the lien.\n * @param amount The amount paid off to deduct from the yIntercept of the PublicVault.\n*/\n```