Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: Vulnerable function: ```\ndiff --git a/test/spell/ichivault.spell.test.ts b/test/spell/ichivault.spel. ```\ndiff --git a/test/spell/ichivault.spell.test.ts b/test/spell/ichivault.spell.test.ts\nindex 258d653..551a6eb 100644\n--- a/test/spell/ichivault.spell.test.ts\n// Add the line below\n// Add the line below\n// Add the line below\n b/test/spell/ichivault.spell.test.ts\n@@ -163,6 // Add the line be

Vulnerable code:
```\ndiff --git a/test/spell/ichivault.spell.test.ts b/test/spell/ichivault.spell.test.ts\nindex 258d653..551a6eb 100644\n--- a/test/spell/ichivault.spell.test.ts\n// Add the line below\n// Add the line below\n// Add the line below\n b/test/spell/ichivault.spell.test.ts\n@@ -163,6 // Add the line below\n163,26 @@ describe('ICHI Angel Vaults Spell', () => {\n                                afterTreasuryBalance.sub(beforeTreasuryBalance)\n                        ).to.be.equal(depositAmount.mul(50).div(10000))\n                })\n// Add the line below\n               it("should revert when exceeds max pos size due to increasing position", async () => {\n// Add the line below\n                       await ichi.approve(bank.address, ethers.constants.MaxUint256);\n// Add the line below\n                       await bank.execute(\n// Add the line below\n                               0,\n// Add the line below\n                               spell.address,\n// Add the line below\n                               iface.encodeFunctionData("openPosition", [\n// Add the line below\n                                       0, ICHI, USDC, depositAmount.mul(4), borrowAmount.mul(6) // Borrow 1.800e6 USDC\n// Add the line below\n                               ])\n// Add the line below\n                       );\n// Add the line below\n\n// Add the line below\n                       await expect(\n// Add the line below\n                               bank.execute(\n// Add the line below\n                                       0,\n// Add the line below\n                                       spell.address,\n// Add the line below\n                                       iface.encodeFunctionData("openPosition", [\n// Add the line below\n                                               0, ICHI, USDC, depositAmount.mul(1), borrowAmount.mul(2) // Borrow 300e6 USDC\n// Add the line below\n                                       ])\n// Add the line below\n                               )\n// Add the line below\n                       ).to.be.revertedWith("EXCEED_MAX_POS_SIZE"); // 1_800e6 // Add the line below\n 300e6 = 2_100e6 > 2_000e6 strategy max position size limit\n// Add the line below\n               })\n                it("should be able to return position risk ratio", async () => {\n                        let risk = await bank.getPositionRisk(1);\n                        console.log('Prev Position Risk', utils.formatUnits(risk, 2), '%');\n```\n
HIGH severity: Vulnerable function: ```\nif (ownerToRollOverQueueIndex[_receiver] != 0) {\n  // if so, update the qu. ```\nif (ownerToRollOverQueueIndex[_receiver] != 0) {\n  // if so, update the queue\n  uint256 index = getRolloverIndex(_receiver);\n  rolloverQueue[index].assets = _assets;\n  rolloverQueue[index].epochId = _epochId;\n```\n

Vulnerable code:
```\nif (ownerToRollOverQueueIndex[_receiver] != 0) {\n  // if so, update the queue\n  uint256 index = getRolloverIndex(_receiver);\n  rolloverQueue[index].assets = _assets;\n  rolloverQueue[index].epochId = _epochId;\n```\n
HIGH severity: Vulnerable function: ```\nFile: contracts\OperatorTokenomics\StreamrConfig.sol\n    /**\n     * Minimum amount to pay rev. ```\nFile: contracts\OperatorTokenomics\StreamrConfig.sol\n    /**\n     * Minimum amount to pay reviewers+flagger\n     * That is: minimumStakeWei >= (flaggerRewardWei + flagReviewerCount * flagReviewerRewardWei) / slashingFraction\n     */\n    function minimumStakeWei() public view returns (uint)

Vulnerable code:
```\nFile: contracts\OperatorTokenomics\StreamrConfig.sol\n    /**\n     * Minimum amount to pay reviewers+flagger\n     * That is: minimumStakeWei >= (flaggerRewardWei + flagReviewerCount * flagReviewerRewardWei) / slashingFraction\n     */\n    function minimumStakeWei() public view returns (uint) {\n        return (flaggerRewardWei + flagReviewerCount * flagReviewerRewardWei) * 1 ether / slashingFraction;\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\nFile: AuraSpell.sol\n    function openPositionFarm(\n        OpenPosParam calldata param,\n    . ```\nFile: AuraSpell.sol\n    function openPositionFarm(\n        OpenPosParam calldata param,\n        uint256 minimumBPT\n    )\n// rest of code\n    {\n// rest of code\n        /// 3. Add liquidity to the Balancer pool and receive BPT in return.\n        {\n// rest of code\n            if (poolAm

Vulnerable code:
```\nFile: AuraSpell.sol\n    function openPositionFarm(\n        OpenPosParam calldata param,\n        uint256 minimumBPT\n    )\n// rest of code\n    {\n// rest of code\n        /// 3. Add liquidity to the Balancer pool and receive BPT in return.\n        {\n// rest of code\n            if (poolAmountOut != 0) {\n                vault.joinPool(\n                    wAuraPools.getBPTPoolId(lpToken),\n                    address(this),\n                    address(this),\n                    IBalancerVault.JoinPoolRequest({\n                        assets: tokens,\n                        maxAmountsIn: maxAmountsIn,\n                        userData: abi.encode(1, amountsIn, _minimumBPT),\n                        fromInternalBalance: false\n                    })\n                );\n            }\n        }\n// rest of code\n    }\n// rest of code\n    function _getJoinPoolParamsAndApprove(\n        address vault,\n        address[] memory tokens,\n        uint256[] memory balances,\n        address lpToken\n    ) internal returns (uint256[] memory, uint256[] memory, uint256) {\n// rest of code\n        uint256 length = tokens.length;\n        uint256[] memory maxAmountsIn = new uint256[](length);\n        uint256[] memory amountsIn = new uint256[](length);\n        bool isLPIncluded;\n        for (i; i != length; ) {\n            if (tokens[i] != lpToken) {\n                amountsIn[j] = IERC20(tokens[i]).balanceOf(address(this));\n                if (amountsIn[j] > 0) {\n                    _ensureApprove(tokens[i], vault, amountsIn[j]);\n                }\n                ++j;\n            } else isLPIncluded = true;\n            maxAmountsIn[i] = IERC20(tokens[i]).balanceOf(address(this));\n            unchecked {\n                ++i;\n            }\n        }\n        if (isLPIncluded) {\n            assembly {\n                mstore(amountsIn, sub(mload(amountsIn), 1))\n            }\n        }\n// rest of code\n        return (maxAmountsIn, amountsIn, poolAmountOut);\n    }\n```\n
HIGH severity: Vulnerable function: ```\nuint256 activeAgents = gameInfo.activeAgents;\n        if (activeAgents == . ```\nuint256 activeAgents = gameInfo.activeAgents;\n        if (activeAgents == 1) {\n            revert GameOver();\n        }\n```\n

Vulnerable code:
```\nuint256 activeAgents = gameInfo.activeAgents;\n        if (activeAgents == 1) {\n            revert GameOver();\n        }\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction _queueLockUpdate(\n    address _owner,\n    uint256 _lockId,\n    uint256 _amount,\n  . ```\nfunction _queueLockUpdate(\n    address _owner,\n    uint256 _lockId,\n    uint256 _amount,\n    uint64 _lockingDuration\n) internal onlyLockOwner(_lockId, _owner) {\n    Lock memory lock = _getQueuedLockState(_lockId);\n    LockUpdate memory lockUpdate = LockUpdate(updateBatchIndex, _updateLoc

Vulnerable code:
```\nfunction _queueLockUpdate(\n    address _owner,\n    uint256 _lockId,\n    uint256 _amount,\n    uint64 _lockingDuration\n) internal onlyLockOwner(_lockId, _owner) {\n    Lock memory lock = _getQueuedLockState(_lockId);\n    LockUpdate memory lockUpdate = LockUpdate(updateBatchIndex, _updateLock(lock, _amount, _lockingDuration));\n    queuedLockUpdates[_lockId].push(lockUpdate);\n    queuedRESDLSupplyChange +=\n        int256(lockUpdate.lock.amount + lockUpdate.lock.boostAmount) -\n        int256(lock.amount + lock.boostAmount);\n    // rest of code\n}\n```\n
HIGH severity: Vulnerable function: ```\nuint256 _maturity = utils.getFutureMaturity(targetDuration);\n\nfunction getFutureMaturity(uint. ```\nuint256 _maturity = utils.getFutureMaturity(targetDuration);\n\nfunction getFutureMaturity(uint256 monthsForward) public view returns (uint256) {\n    (uint256 year, uint256 month, ) = DateTime.timestampToDate(DateTime.addMonths(block.timestamp, monthsForward));\n    return DateTime.timestampFr

Vulnerable code:
```\nuint256 _maturity = utils.getFutureMaturity(targetDuration);\n\nfunction getFutureMaturity(uint256 monthsForward) public view returns (uint256) {\n    (uint256 year, uint256 month, ) = DateTime.timestampToDate(DateTime.addMonths(block.timestamp, monthsForward));\n    return DateTime.timestampFromDateTime(year, month, 1 /* top of the month */, 0, 0, 0);\n}\n```\n
MEDIUM severity: Vulnerable function: ```\n int256 rawCollateralPrice = strategy.collateralPriceOracle.latestAnswer();. ```\n int256 rawCollateralPrice = strategy.collateralPriceOracle.latestAnswer();\n        rebalanceInfo.collateralPrice = rawCollateralPrice.toUint256().mul(10 ** strategy.collateralDecimalAdjustment);\n        int256 rawBorrowPrice = strategy.borrowPriceOracle.latestAnswer();\n        rebalanceInfo

Vulnerable code:
```\n int256 rawCollateralPrice = strategy.collateralPriceOracle.latestAnswer();\n        rebalanceInfo.collateralPrice = rawCollateralPrice.toUint256().mul(10 ** strategy.collateralDecimalAdjustment);\n        int256 rawBorrowPrice = strategy.borrowPriceOracle.latestAnswer();\n        rebalanceInfo.borrowPrice = rawBorrowPrice.toUint256().mul(10 ** strategy.borrowDecimalAdjustment);\n```\n
MEDIUM severity: Vulnerable function: ```\nThe feeMultiplier enables the admin to subsidize or upcharge for the automa. ```\nThe feeMultiplier enables the admin to subsidize or upcharge for the automation service.\n/**\n⦁ @notice feeMultiplier represents the total fee to be charged on the transaction\n⦁ Is set to 100% by default\n⦁ @dev In case feeMultiplier is less than BASE_BPS, fees charged will be less than 100%,

Vulnerable code:
```\nThe feeMultiplier enables the admin to subsidize or upcharge for the automation service.\n/**\n⦁ @notice feeMultiplier represents the total fee to be charged on the transaction\n⦁ Is set to 100% by default\n⦁ @dev In case feeMultiplier is less than BASE_BPS, fees charged will be less than 100%,\n⦁ subsidizing the transaction\n⦁ In case feeMultiplier is greater than BASE_BPS, fees charged will be greater than 100%,\n⦁ charging the user for the transaction\n*/ \n      uint16 public feeMultiplier = 10_000;\n        // The normal fee is calculated and then processed by the multiplier.\n  if (feeToken == ETH) {\n         uint256 totalFee = (gasUsed + GAS_OVERHEAD_NATIVE) * tx.gasprice; \n      totalFee = _applyMultiplier(totalFee);\n    return (totalFee, recipient, TokenTransfer._nativeTransferExec(recipient, totalFee));\n  } else {\n```\n
MEDIUM severity: Vulnerable function: ```\nSLeverageSwapData memory swapData = abi.decode(data, (SLeverageSwapData));\. ```\nSLeverageSwapData memory swapData = abi.decode(data, (SLeverageSwapData));\nuint256 daiAmount =\n    _swapAndTransferToSender(false, assetAddress, daiAddress, assetAmountIn, swapData.swapperData);\n```\n

Vulnerable code:
```\nSLeverageSwapData memory swapData = abi.decode(data, (SLeverageSwapData));\nuint256 daiAmount =\n    _swapAndTransferToSender(false, assetAddress, daiAddress, assetAmountIn, swapData.swapperData);\n```\n
HIGH severity: Vulnerable function: ```\nfunction eject(\n    uint256 shares,\n    address receiver,\n    address owner\n) public return. ```\nfunction eject(\n    uint256 shares,\n    address receiver,\n    address owner\n) public returns (uint256 assets, uint256 excessBal, bool isExcessPTs) {\n\n    // rest of code\n\n    //@audit call of interest\n    (excessBal, isExcessPTs) = _exitAndCombine(shares);\n\n    _burn(owner, shares); 

Vulnerable code:
```\nfunction eject(\n    uint256 shares,\n    address receiver,\n    address owner\n) public returns (uint256 assets, uint256 excessBal, bool isExcessPTs) {\n\n    // rest of code\n\n    //@audit call of interest\n    (excessBal, isExcessPTs) = _exitAndCombine(shares);\n\n    _burn(owner, shares); // Burn after percent ownership is determined in _exitAndCombine.\n\n    if (isExcessPTs) {\n        pt.transfer(receiver, excessBal);\n    } else {\n        yt.transfer(receiver, excessBal);\n    }\n\n    //@audit entire asset (adapter.target) balance transferred to caller, which includes collected YT yield and combined\n    asset.transfer(receiver, assets = asset.balanceOf(address(this)));\n\n    emit Ejected(msg.sender, receiver, owner, assets, shares,\n        isExcessPTs ? excessBal : 0,\n        isExcessPTs ? 0 : excessBal\n    );\n}\n\nfunction _exitAndCombine(uint256 shares) internal returns (uint256, bool) {\n    uint256 supply = totalSupply; // Save extra SLOAD.\n\n    uint256 lpBal      = shares.mulDivDown(space.balanceOf(address(this)), supply);\n    uint256 totalPTBal = pt.balanceOf(address(this));\n    uint256 ptShare    = shares.mulDivDown(totalPTBal, supply);\n\n    // rest of code\n\n    uint256 ytBal = shares.mulDivDown(yt.balanceOf(address(this)), supply);\n    ptShare += pt.balanceOf(address(this)) - totalPTBal;\n\n    unchecked {\n        // Safety: an inequality check is done before subtraction.\n        if (ptShare > ytBal) {\n\n            //@audit call of interest\n            divider.combine(address(adapter), maturity, ytBal);\n            return (ptShare - ytBal, true);\n        } else { // Set excess PTs to false if the balances are exactly equal.\n            divider.combine(address(adapter), maturity, ptShare);\n            return (ytBal - ptShare, false);\n        }\n    }\n}\n```\n
HIGH severity: Vulnerable function: ```\ntry IDepositCallbackReceiver(deposit.callbackContract()).afterDepositExecut. ```\ntry IDepositCallbackReceiver(deposit.callbackContract()).afterDepositExecution{ gas: deposit.callbackGasLimit() }(key, deposit) {\n        } catch (bytes memory reasonBytes) {\n            (string memory reason, /* bool hasRevertMessage */) = ErrorUtils.getRevertMessage(reasonBytes);\n         

Vulnerable code:
```\ntry IDepositCallbackReceiver(deposit.callbackContract()).afterDepositExecution{ gas: deposit.callbackGasLimit() }(key, deposit) {\n        } catch (bytes memory reasonBytes) {\n            (string memory reason, /* bool hasRevertMessage */) = ErrorUtils.getRevertMessage(reasonBytes);\n            emit AfterDepositExecutionError(key, deposit, reason, reasonBytes);\n        }\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction getSavedOrSpotOraclePrice(address asset) internal view returns (uint256) {\n    if (Li. ```\nfunction getSavedOrSpotOraclePrice(address asset) internal view returns (uint256) {\n    if (LibOrders.getOffsetTime() - getTime(asset) < 15 minutes) {\n        return getPrice(asset);\n    } else {\n        return getOraclePrice(asset);\n    }\n}\n```\n

Vulnerable code:
```\nfunction getSavedOrSpotOraclePrice(address asset) internal view returns (uint256) {\n    if (LibOrders.getOffsetTime() - getTime(asset) < 15 minutes) {\n        return getPrice(asset);\n    } else {\n        return getOraclePrice(asset);\n    }\n}\n```\n
MEDIUM severity: Vulnerable function: ```\n} else {\n    // Deduct the external swap fee\n    uint256 fee = (bridgedAm. ```\n} else {\n    // Deduct the external swap fee\n    uint256 fee = (bridgedAmount * dstExternalFeeRate) / FEE_BASE;\n    bridgedAmount -= fee;  // @@audit: fee should not be applied to internal swap \n\n    TransferHelper.safeApprove(bridgedToken, address(wooRouter), bridgedAmount);\n    if (dst1

Vulnerable code:
```\n} else {\n    // Deduct the external swap fee\n    uint256 fee = (bridgedAmount * dstExternalFeeRate) / FEE_BASE;\n    bridgedAmount -= fee;  // @@audit: fee should not be applied to internal swap \n\n    TransferHelper.safeApprove(bridgedToken, address(wooRouter), bridgedAmount);\n    if (dst1inch.swapRouter != address(0)) {\n        try\n            wooRouter.externalSwap(\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction \_startRotation(bytes32 schainIndex, uint nodeIndex) private {\n    ConstantsHolder co. ```\nfunction \_startRotation(bytes32 schainIndex, uint nodeIndex) private {\n    ConstantsHolder constants = ConstantsHolder(contractManager.getContract("ConstantsHolder"));\n    rotations[schainIndex].nodeIndex = nodeIndex;\n    rotations[schainIndex].newNodeIndex = nodeIndex;\n    rotations[schai

Vulnerable code:
```\nfunction \_startRotation(bytes32 schainIndex, uint nodeIndex) private {\n    ConstantsHolder constants = ConstantsHolder(contractManager.getContract("ConstantsHolder"));\n    rotations[schainIndex].nodeIndex = nodeIndex;\n    rotations[schainIndex].newNodeIndex = nodeIndex;\n    rotations[schainIndex].freezeUntil = now.add(constants.rotationDelay());\n    waitForNewNode[schainIndex] = true;\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction drawDebt(\n    address borrowerAddress_,\n    uint256 amountToBorrow_,\n    uint256 li. ```\nfunction drawDebt(\n    address borrowerAddress_,\n    uint256 amountToBorrow_,\n    uint256 limitIndex_,\n    uint256 collateralToPledge_\n) external nonReentrant {\n    PoolState memory poolState = _accruePoolInterest();\n\n   // rest of code\n\n    DrawDebtResult memory result = BorrowerActi

Vulnerable code:
```\nfunction drawDebt(\n    address borrowerAddress_,\n    uint256 amountToBorrow_,\n    uint256 limitIndex_,\n    uint256 collateralToPledge_\n) external nonReentrant {\n    PoolState memory poolState = _accruePoolInterest();\n\n   // rest of code\n\n    DrawDebtResult memory result = BorrowerActions.drawDebt(\n        auctions,\n        deposits,\n        loans,\n        poolState,\n        _availableQuoteToken(),\n        borrowerAddress_,\n        amountToBorrow_,\n        limitIndex_,\n        collateralToPledge_\n    );\n\n    // rest of code\n\n    // update pool interest rate state\n    _updateInterestState(poolState, result.newLup);\n\n   // rest of code\n}\n```\n
HIGH severity: Vulnerable function: ```\nwAuraPools.getVault(lpToken).exitPool(\n    IBalancerPool(lpToken).getPoolI. ```\nwAuraPools.getVault(lpToken).exitPool(\n    IBalancerPool(lpToken).getPoolId(),\n    address(this),\n    address(this),\n    IBalancerVault.ExitPoolRequest(tokens, minAmountsOut, "", false)\n);\n```\n

Vulnerable code:
```\nwAuraPools.getVault(lpToken).exitPool(\n    IBalancerPool(lpToken).getPoolId(),\n    address(this),\n    address(this),\n    IBalancerVault.ExitPoolRequest(tokens, minAmountsOut, "", false)\n);\n```\n
HIGH severity: Vulnerable function: ```\nfunction getNftPower(uint256 tokenId) public view override returns (uint256) {\n    if (block.t. ```\nfunction getNftPower(uint256 tokenId) public view override returns (uint256) {\n    if (block.timestamp <= powerCalcStartTimestamp) {\n        return 0;\n    }\n\n    // @audit 0 for non-existent tokenId\n    uint256 collateral = nftInfos[tokenId].currentCollateral;\n\n    // Calculate the mini

Vulnerable code:
```\nfunction getNftPower(uint256 tokenId) public view override returns (uint256) {\n    if (block.timestamp <= powerCalcStartTimestamp) {\n        return 0;\n    }\n\n    // @audit 0 for non-existent tokenId\n    uint256 collateral = nftInfos[tokenId].currentCollateral;\n\n    // Calculate the minimum possible power based on the collateral of the nft\n    // @audit returns default maxPower for non-existent tokenId\n    uint256 maxNftPower = getMaxPowerForNft(tokenId);\n    uint256 minNftPower = maxNftPower.ratio(collateral, getRequiredCollateralForNft(tokenId));\n    minNftPower = maxNftPower.min(minNftPower);\n\n    // Get last update and current power. Or set them to default if it is first iteration\n    // @audit both 0 for non-existent tokenId\n    uint64 lastUpdate = nftInfos[tokenId].lastUpdate;\n    uint256 currentPower = nftInfos[tokenId].currentPower;\n\n    if (lastUpdate == 0) {\n        lastUpdate = powerCalcStartTimestamp;\n        // @audit currentPower set to maxNftPower which\n        // is just the default maxPower even for non-existent tokenId!\n        currentPower = maxNftPower;\n    }\n\n    // Calculate reduction amount\n    uint256 powerReductionPercent = reductionPercent * (block.timestamp - lastUpdate);\n    uint256 powerReduction = currentPower.min(maxNftPower.percentage(powerReductionPercent));\n    uint256 newPotentialPower = currentPower - powerReduction;\n\n    // @audit returns newPotentialPower slightly reduced\n    // from maxPower for non-existent tokenId\n    if (minNftPower <= newPotentialPower) {\n        return newPotentialPower;\n    }\n\n    if (minNftPower <= currentPower) {\n        return minNftPower;\n    }\n\n    return currentPower;\n}\n\nfunction recalculateNftPower(uint256 tokenId) public override returns (uint256 newPower) {\n    if (block.timestamp < powerCalcStartTimestamp) {\n        return 0;\n    }\n\n    // @audit newPower > 0 for non-existent tokenId\n    newPower = getNftPower(tokenId);\n\n    NftInfo storage nftInfo = nftInfos[tokenId];\n\n    // @audit as this is the first update since\n    // tokenId doesn't exist, totalPower will be\n    // subtracted by nft's max power\n    totalPower -= nftInfo.lastUpdate != 0 ? nftInfo.currentPower : getMaxPowerForNft(tokenId);\n    // @audit then totalPower is increased by newPower where:\n    // 0 < newPower < maxPower hence net decrease to totalPower\n    totalPower += newPower;\n\n    nftInfo.lastUpdate = uint64(block.timestamp);\n    nftInfo.currentPower = newPower;\n}\n```\n
HIGH severity: Vulnerable function: ```\ngaugeQueuedRewards[gauge] = QueuedRewards({\n    priorCycleRewards: queuedR. ```\ngaugeQueuedRewards[gauge] = QueuedRewards({\n    priorCycleRewards: queuedRewards.priorCycleRewards + completedRewards,\n    cycleRewards: uint112(nextRewards),\n    storedCycle: currentCycle\n});\n```\n

Vulnerable code:
```\ngaugeQueuedRewards[gauge] = QueuedRewards({\n    priorCycleRewards: queuedRewards.priorCycleRewards + completedRewards,\n    cycleRewards: uint112(nextRewards),\n    storedCycle: currentCycle\n});\n```\n
HIGH severity: Vulnerable function: ```\nif (!emergencyProcessing) {\n    require(\n        proposal.tributeToken.tr. ```\nif (!emergencyProcessing) {\n    require(\n        proposal.tributeToken.transfer(proposal.proposer, proposal.tributeOffered),\n        "failing vote token transfer failed"\n    );\n```\n

Vulnerable code:
```\nif (!emergencyProcessing) {\n    require(\n        proposal.tributeToken.transfer(proposal.proposer, proposal.tributeOffered),\n        "failing vote token transfer failed"\n    );\n```\n
HIGH severity: Vulnerable function: ```\nFile: PoolMath.sol\n    int256 internal constant N_COINS = 3;\n..SNIP..\n    function swapExact. ```\nFile: PoolMath.sol\n    int256 internal constant N_COINS = 3;\n..SNIP..\n    function swapExactBaseLpTokenForUnderlying(PoolState memory pool, uint256 exactBaseLptIn)\n        internal\n..SNIP..\n            // Note: Here we are multiplying by N_COINS because the swap formula is defined in term

Vulnerable code:
```\nFile: PoolMath.sol\n    int256 internal constant N_COINS = 3;\n..SNIP..\n    function swapExactBaseLpTokenForUnderlying(PoolState memory pool, uint256 exactBaseLptIn)\n        internal\n..SNIP..\n            // Note: Here we are multiplying by N_COINS because the swap formula is defined in terms of the amount of PT being swapped.\n            // BaseLpt is equivalent to 3 times the amount of PT due to the initial deposit of 1:1:1:1=pt1:pt2:pt3:Lp share in Curve pool.\n            exactBaseLptIn.neg() * N_COINS\n..SNIP..\n    function swapUnderlyingForExactBaseLpToken(PoolState memory pool, uint256 exactBaseLptOut)\n..SNIP..\n        (int256 _netUnderlyingToAccount18, int256 _netUnderlyingFee18, int256 _netUnderlyingToProtocol18) = executeSwap(\n            pool,\n            // Note: sign is defined from the perspective of the swapper.\n            // positive because the swapper is buying pt\n            exactBaseLptOut.toInt256() * N_COINS\n```\n