Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: The `_redeem` function in the `Boosted3TokenPoolUtils.sol` contract is responsible for claiming BPT . The `_redeem` function in the `Boosted3TokenPoolUtils.sol` contract is responsible for claiming BPT amounts using strategy tokens. This function first calls the `_unstakeAndExitPool` function, which likely performs some unstaking and exit operations, and then updates the `totalBPTHeld` and `totalStr...

Vulnerable code:
```\nfunction _redeem(\n    ThreeTokenPoolContext memory poolContext,\n    StrategyContext memory strategyContext,\n    AuraStakingContext memory stakingContext,\n    uint256 strategyTokens,\n    uint256 minPrimary\n) internal returns (uint256 finalPrimaryBalance) {\n    uint256 bptClaim = strategyContext._convertStrategyTokensToBPTClaim(strategyTokens);\n\n    if (bptClaim == 0) {\n        return 0;\n    }\n\n    finalPrimaryBalance = _unstakeAndExitPool({\n        stakingContext: stakingContext,\n        poolContext: poolContext,\n        bptClaim: bptClaim,\n        minPrimary: minPrimary\n    });\n\n    strategyContext.vaultState.totalBPTHeld -= bptClaim;\n    strategyContext.vaultState.totalStrategyTokenGlobal -= uint256(strategyTokens);\n    strategyContext.vaultState.setStrategyVaultState();\n}\n```
MEDIUM severity: The vulnerability arises from an incorrect approach to tracking the profit and loss (PnL) of a Desti. The vulnerability arises from an incorrect approach to tracking the profit and loss (PnL) of a Destination Vault (DV). Specifically, the code fails to accurately reflect the PnL situation after a rebalancing event.\n\nWhen the DV's current debt value (currentDvDebtValue) is less than its last debt v...

Vulnerable code:
```\nFile: LMPDebt.sol\n\nif (currentDvDebtValue < updatedDebtBasis) {\n    // We are currently sitting at a loss. Limit the value we can pull from the destination vault\n    currentDvDebtValue = currentDvDebtValue.mulDiv(userShares, totalVaultShares, Math.Rounding.Down);\n    currentDvShares = currentDvShares.mulDiv(userShares, totalVaultShares, Math.Rounding.Down);\n}\n```
MEDIUM severity: The `bitcoin-spv` library contains a redundant implementation of the double `sha256` hash function, . The `bitcoin-spv` library contains a redundant implementation of the double `sha256` hash function, which is a critical component of the Bitcoin protocol. This implementation is present in two forms: a Solidity native implementation and an assembly implementation.\n\nThe Solidity native implementati...

Vulnerable code:
```\nfunction hash256(bytes memory _b) internal pure returns (bytes32) {\n    return abi.encodePacked(sha256(abi.encodePacked(sha256(_b)))).toBytes32();\n}\n```\n```\nfunction hash256View(bytes memory _b) internal view returns (bytes32 res) {\n    assembly {\n        let ptr := mload(0x40)\n        pop(staticcall(gas, 2, add(_b, 32), mload(_b), ptr, 32))\n        pop(staticcall(gas, 2, ptr, 32, ptr, 32))\n        res := mload(ptr)\n    }\n}\n```
MEDIUM severity: The `removeMakerFromStakingPool` function contains a vulnerability that allows an attacker to tempor. The `removeMakerFromStakingPool` function contains a vulnerability that allows an attacker to temporarily prevent makers from joining a pool. This is achieved by exploiting the `safeSub` operation, which catches an underflow when the number of makers in the pool is reduced to zero.\n\nWhen an attack...

Vulnerable code:
```\npoolById[poolId].numberOfMakers = uint256(poolById[poolId].numberOfMakers).safeSub(1).downcastToUint32();\n```\n```\npoolJoinStatus = IStructs.MakerPoolJoinStatus({\n    poolId: poolId,\n    confirmed: true\n});\n\n_poolJoinedByMakerAddress[makerAddress] = poolJoinStatus;\n\n_poolById[poolId].numberOfMakers = uint256(pool.numberOfMakers).safeAdd(1).downcastToUint32();\n```\n```\ndelete _poolJoinedByMakerAddress[makerAddress];\n_poolById[poolId].numberOfMakers = uint256(_poolById[poolId].numberOfMakers).safeSub(1).downcastToUint32();\n```
MEDIUM severity: The `WH_TRANSCEIVER_PAYLOAD_PREFIX` constant in `WormholeTransceiverState.sol` is defined as `0x9945. The `WH_TRANSCEIVER_PAYLOAD_PREFIX` constant in `WormholeTransceiverState.sol` is defined as `0x9945FF10`, which is an incorrect representation of the expected prefix for TransceiverMessage payloads. The inline developer documentation provides a description of the expected prefix as a magic string,...

Vulnerable code:
```\nbytes4 constant WH_TRANSCEIVER_PAYLOAD_PREFIX = 0x9945FF10;\n```\n```\ncast\n--from-utf8\n"EWH"\n```
MEDIUM severity: The `_increasePosition()` function is responsible for updating the Hedger's GMX position by adjustin. The `_increasePosition()` function is responsible for updating the Hedger's GMX position by adjusting the `sizeDelta` amount and `collateralDelta` collateral. The `collateralDelta` is corrected twice, once for swap fees and once for position fees. However, the swap fee calculation is dependent on th...

Vulnerable code:
```\nif (isLong) {\n    uint swapFeeBP = getSwapFeeBP(isLong, true, collateralDelta);\n    collateralDelta = (collateralDelta * (BASIS_POINTS_DIVISOR + swapFeeBP)) / BASIS_POINTS_DIVISOR;\n}\n\ncollateralDelta += _getPositionFee(currentPos.size, sizeDelta, currentPos.entryFundingRate);\n```
MEDIUM severity: The vulnerability in the Teller removal mechanism of the Callback Contract allows an attacker to per. The vulnerability in the Teller removal mechanism of the Callback Contract allows an attacker to persistently exploit a vulnerable Teller, even after the owner of the Callback Contract has identified the issue. This is because the Callback Contract lacks the capability to remove a Teller from the ap...

Vulnerable code:
```\nFile: BondBaseCallback.sol\n\n/// @inheritdoc IBondCallback\nfunction whitelist(address teller_, uint256 id_) external override onlyOwner {\n    // Check that the market id is a valid, live market on the aggregator\n    try _aggregator.isLive(id_) returns (bool live) {\n        if (!live) revert Callback_MarketNotSupported(id_);\n    } catch {\n        revert Callback_MarketNotSupported(id_);\n    }\n\n    // Check that the provided teller is the teller for the market ID on the stored aggregator\n    // We could pull the teller from the aggregator, but requiring the teller to be passed in\n    // is more explicit about which contract is being whitelisted\n    if (teller_!= address(_aggregator.getTeller(id_))) revert Callback_TellerMismatch();\n\n    approvedMarkets[teller_][id_] = true;\n```
MEDIUM severity: The `UniProxy.properDepositRatio` function is designed to prevent liquidity imbalance by comparing t. The `UniProxy.properDepositRatio` function is designed to prevent liquidity imbalance by comparing the deposit ratio with the hype ratio, which is the ratio between the tokens held by the `Hypervisor` contract. However, this mechanism is flawed and will not prevent a skewed deposit ratio in many cas...

Vulnerable code:
```\nfunction properDepositRatio(\n  address pos,\n  uint256 deposit0,\n  uint256 deposit1\n) public view returns (bool) {\n  (uint256 hype0, uint256 hype1) = IHypervisor(pos).getTotalAmounts();\n  if (IHypervisor(pos).totalSupply()!= 0) {\n    uint256 depositRatio = deposit0 == 0\n     ? 10e18\n      : deposit1.mul(1e18).div(deposit0);\n    depositRatio = depositRatio > 10e18\n     ? 10e18\n      : depositRatio;\n    depositRatio = depositRatio < 10e16\n     ? 10e16\n      : depositRatio;\n    uint256 hypeRatio = hype0 == 0\n     ? 10e18\n      : hype1.mul(1e18).div(hype0);\n    hypeRatio = hypeRatio > 10e18\n     ? 10e18\n      : hypeRatio;\n    hypeRatio = hypeRatio < 10e16\n     ? 10e16\n      : hypeRatio;\n    return (\n      FullMath.mulDiv(depositRatio, deltaScale, hypeRatio) < depositDelta &&\n      FullMath.mulDiv(hypeRatio, deltaScale, depositRatio) < depositDelta\n    );\n  }\n  return true;\n```
MEDIUM severity: The `findMarketFor()` function in the `BondAggregator` contract lacks a crucial check on the "payout. The `findMarketFor()` function in the `BondAggregator` contract lacks a crucial check on the "payout" value returned by the `payoutFor()` function. Specifically, the function does not verify that the calculated "payout" is greater than or equal to the minimum amount `minAmountOut_` specified in the...

Vulnerable code:
```\nfunction findMarketFor(\n    address payout_,\n    address quote_,\n    uint256 amountIn_,\n    uint256 minAmountOut_,\n    uint256 maxExpiry_\n) external view returns (uint256) {\n    if (expiry <= maxExpiry_) {\n        payouts[i] = minAmountOut_ <= maxPayout\n           ? payoutFor(amountIn_, ids[i], address(0))\n            : 0;\n\n        if (payouts[i] > highestOut) {\n            highestOut = payouts[i];\n            id = ids[i];\n        }\n    }\n```
MEDIUM severity: This vulnerability involves the lack of immutability in several fields within the code, which can le. This vulnerability involves the lack of immutability in several fields within the code, which can lead to unintended changes and potential security risks. Immutability is a fundamental concept in programming that ensures the integrity of data by preventing it from being modified once it has been cre...

Vulnerable code:
```\nstring _name;\n```\n```\nstring _symbol;\n```\n```\nISwapToken public swapToken;\n```\n```\npublic class Address {\n    public String amp;\n}\n```
MEDIUM severity: The `_delegateTokens` method in the `TokenDistributor` contract is responsible for delegating tokens. The `_delegateTokens` method in the `TokenDistributor` contract is responsible for delegating tokens to a specified address on behalf of a delegator. This method is called when a user claims their tokens and wants to automatically delegate the claimed tokens to their own address or a different one....

Vulnerable code:
```\ndelegateTokens(user_address, delegate_address);\n```\n```\n/**\n * @notice Execute call on token contract to delegate tokens\n * @return boolean true on success\n */\nfunction _delegateTokens(address delegator, address delegatee) private returns (bool) {\n    GTCErc20 GTCToken = GTCErc20(token);\n    GTCToken.delegateOnDist(delegator, delegatee);\n    return true;\n}\n```
MEDIUM severity: The vulnerability arises from a governance action in the `Governance::submitNewGuardianSet` function. The vulnerability arises from a governance action in the `Governance::submitNewGuardianSet` function, which updates the Guardian set via Governance VAA. This update triggers a time-based expiry of the current guardian set, which is set to expire after 24 hours. However, any in-flight VAAs that utili...

Vulnerable code:
```\nfunction submitNewGuardianSet(bytes memory _vm) public {\n    // Trigger a time-based expiry of current guardianSet\n    expireGuardianSet(getCurrentGuardianSetIndex());\n\n    // Add the new guardianSet to guardianSets\n    storeGuardianSet(upgrade.newGuardianSet, upgrade.newGuardianSetIndex);\n\n    // Makes the new guardianSet effective\n    updateGuardianSetIndex(upgrade.newGuardianSetIndex);\n}\n```\n```\nfunction expireGuardianSet(uint32 index) internal {\n    _state.guardianSets[index].expirationTime = uint32(block.timestamp) + 86400;\n```\n```\nif (vm.guardianSetIndex!= getCurrentGuardianSetIndex() && guardianSet.expirationTime < block.timestamp):\n    return (false, "guardian set has expired")\n```\n```\nrequire(\n    msg.sender.toUniversalAddress() == deposit.mintRecipient,\n    "caller must be mintRecipient"\n);\n```
MEDIUM severity: The vulnerability allows an attacker to manipulate the total staked amount in the SDLPoolPrimary con. The vulnerability allows an attacker to manipulate the total staked amount in the SDLPoolPrimary contract by locking and unlocking the fund in the same transaction. This can be achieved by using a flash loan to borrow a large amount of funds, locking the funds in the SDLPoolPrimary contract, and the...

Vulnerable code:
```\nnpx hardhat test\n  --network hardhat\n  --grep 'usage of Attack contract and receiving NFT'\n```\n```\nimport { Signer } from 'ethers';\nimport { assert, expect } from 'chai';\nimport {\n  toEther,\n  deploy,\n  getAccounts,\n  setupToken,\n  fromEther,\n  deployUpgradeable,\n} from '../../utils/helpers';\nimport {\n  ERC677,\n  LinearBoostController,\n  RewardsPool,\n  SDLPoolPrimary,\n  StakingAllowance,\n  Attacker,\n} from '../../../typechain-types';\nimport { ethers } from 'hardhat';\nimport { time } from '@nomicfoundation/hardhat-network-helpers';\n\nconst DAY = 86400;\n\nconst parseLocks = (locks: any) =>\n  locks.map((l: any) => ({\n    amount: fromEther(l.amount),\n    boostAmount: Number(fromEther(l.boostAmount).toFixed(10)),\n    startTime: l.startTime.toNumber(),\n    duration: l.duration.toNumber(),\n    expiry: l.expiry.toNumber(),\n  }));\n\nconst parseData = (data: any) => ({\n  operator: data.operator,\n  from: data.from,\n  tokenId: data.tokenId,\n  data: Buffer.from(data.data.slice(2), 'hex').toString('utf8'),\n});\n\ndescribe('SDLPoolPrimary', () => {\n  let sdlToken: StakingAllowance;\n  let rewardToken: ERC677;\n  let rewardsPool: RewardsPool;\n  let boostController: LinearBoostController;\n  let sdlPool: SDLPoolPrimary;\n  let signers: Signer[];\n  let accounts: string[];\n  let attacker: Attacker;\n\n  before(async () => {\n    ({ signers, accounts } = await getAccounts());\n  });\n\n  beforeEach(async () => {\n    sdlToken = (await deploy('StakingAllowance', ['stake.link', 'SDL'])) as StakingAllowance;\n    rewardToken = (await deploy('ERC677', ['Chainlink', 'LINK', 1000000000])) as ERC677;\n\n    await sdlToken.mint(accounts[0], toEther(1000000));\n    await setupToken(sdlToken, accounts);\n\n    boostController = (await deploy('LinearBoostController', [4 * 365 * DAY, 4])) as LinearBoostController;\n\n    sdlPool = (await deployUpgradeable('SDLPoolPrimary', [\n      'Reward Escrowed SDL',\n     'reSDL',\n      sdlToken.address,\n      boostController.address,\n    ])) as SDLPoolPrimary;\n\n    rewardsPool = (await deploy('RewardsPool',\n```
MEDIUM severity: The vulnerability arises when the L2 sequencer, responsible for processing transactions on Arbitrum . The vulnerability arises when the L2 sequencer, responsible for processing transactions on Arbitrum and Optimism, experiences downtime or outage. This can occur due to various reasons, such as software upgrades, bugs, or technical issues. During this time, the option token, which is tied to a specif...

Vulnerable code:
```\nif (uint48(block.timestamp) >= expiry) {\n    revert Teller_OptionExpired(expiry);\n}\n```\n```\nfunction _claimRewards() internal returns (uint256) {\n    // Claims all outstanding rewards for the user across epochs\n    // If there are unclaimed rewards from epochs where the option token has expired, the rewards are lost\n\n    uint48 userLastEpoch = lastEpochClaimed[msg.sender];\n```\n```\nif (uint256(optionToken.expiry()) < block.timestamp) return 0;\n```\n```\nQ: On what chains are the smart contracts going to be deployed?\n\nMainnet\nArbitrum\nOptimism\n```
MEDIUM severity: The vulnerability lies in the design of the protocol's gas yield mechanism, which is intended to be . The vulnerability lies in the design of the protocol's gas yield mechanism, which is intended to be deployed on a blast network. The protocol's default settings for both ETH and GAS yields are set to VOID, meaning that unless explicitly configured to claimable, the yield will not be received. The is...

Vulnerable code:
```\nconstructor(address auctionHouse_) {\n    LinearVesting(auctionHouse_);\n    BlastGas(auctionHouse_);\n}\n```\n```\nconstructor(address parent_) {\n    IBlast(0x4300000000000000000000000000000000000002).configureGovernor(parent_);\n}\n```
MEDIUM severity: The PeriodicPrizeStrategy contract is vulnerable to manipulation when allowing callback-enabled toke. The PeriodicPrizeStrategy contract is vulnerable to manipulation when allowing callback-enabled tokens, such as ERC777 or other ERC721/ERC20 extensions, as awards. This vulnerability is highly dependent on the system configuration, specifically the allowance of callback-enabled tokens as rewards.\n\...

Vulnerable code:
```\nfunction _awardExternalErc721s(address winner) internal {\n    address currentToken = externalErc721s.start();\n    while (currentToken!= address(0) && currentToken!= externalErc721s.end()) {\n        uint256 balance = IERC721(currentToken).balanceOf(address(prizePool));\n        if (balance > 0) {\n            prizePool.awardExternalERC721(winner, currentToken, externalErc721TokenIds[currentToken]);\n            delete externalErc721TokenIds[currentToken];\n        }\n        currentToken = externalErc721s.next(currentToken);\n    }\n    externalErc721s.clearAll();\n}\n```
MEDIUM severity: The `RocketDAOProtocolProposal._propose()` function is susceptible to a critical vulnerability due t. The `RocketDAOProtocolProposal._propose()` function is susceptible to a critical vulnerability due to its failure to account for scenarios where the `_blockNumber` parameter exceeds the current `block.number`. This oversight has significant implications for the voting power calculation, as it render...

Vulnerable code:
```\nfunction _propose(string memory _proposalMessage, uint256 _blockNumber, uint256 _totalVotingPower, bytes calldata _payload) internal returns (uint256) {\n    return _propose(_proposalMessage, _blockNumber, _totalVotingPower, _payload);\n}\n```
MEDIUM severity: The linking of hat trees, a feature that enables hats from one node to connect to the first level of. The linking of hat trees, a feature that enables hats from one node to connect to the first level of a different domain, can have severe consequences if not properly checked. This feature allows the amount of levels in the linked-to tree to increase by the linked-from level count, which can lead to...

Vulnerable code:
```\nfunction getHatLevel(uint256 _hatId) public view returns (uint8) {\n    /// @notice Identifies the level a given hat in its hat tree\n    /// @param _hatId the id of the hat in question\n    /// @return level (0 to uint8.max)\n    // Your code here\n}\n```\n```\nif (treeAdmin!= 0) {\n    return 1 + uint8(i) + getHatLevel(treeAdmin);\n}\n```
MEDIUM severity: This vulnerability, known as "zNS - Avoid no-ops", refers to a situation where code paths in a smart. This vulnerability, known as "zNS - Avoid no-ops", refers to a situation where code paths in a smart contract are designed to execute transactions that do not result in any meaningful changes to the contract's state. This can occur when a transaction is initiated, but the outcome is essentially a "n...

Vulnerable code:
```\nfunction addController(address controller) external override onlyOwner {\n    controllers[controller] = true;\n    emit ControllerAdded(controller);\n}\n\n/**\n * @notice Unauthorizes a controller to control the registrar\n * @param controller The address of the controller\n */\nfunction removeController(address controller) external override onlyOwner {\n    controllers[controller] = false;\n    emit ControllerRemoved(controller);\n```
MEDIUM severity: The `getOwnValuation()` function in the provided code contains errors in the price calculation logic. The `getOwnValuation()` function in the provided code contains errors in the price calculation logic, specifically when `token0()` or `token1()` is equal to USSD. The incorrect calculation leads to inaccurate price calculations.\n\nThe `USSDRebalancer.getOwnValuation()` function relies on the `uniPo...

Vulnerable code:
```\nprice = uint(sqrtPriceX96) * (uint(sqrtPriceX96)) / (1e6) * (96 * 2)\n```\n```\nprice = uint(sqrtPriceX96) * uint(sqrtPriceX96) * 1e6  # (96 * 2)\n```\n```\nprice = uint(sqrtPriceX96) * (uint(sqrtPriceX96)) * (1e18 * (96 * 2));\nprice = (1e24 / price) / 1e12\n```\n```\nprice = uint(sqrtPriceX96) * (uint(sqrtPriceX96)) * (1e6 * (1e12 + 1e6)) * 96 * 2;\nprice = (1e24 / price) / 1e12;\n```
MEDIUM severity: The `_getInterest()` function, responsible for calculating interest amounts, is vulnerable to an inc. The `_getInterest()` function, responsible for calculating interest amounts, is vulnerable to an incorrect calculation due to the use of `block.timestamp` instead of the inputted timestamp. This oversight can lead to inaccurate interest values being returned to other functions.\n\nThe function is de...

Vulnerable code:
```\nif (block.timestamp >= lien.start + lien.duration) {\n    delta_t = uint256(lien.start + lien.duration - lien.last);\n}\n```
MEDIUM severity: The `_createActionInfo()` function in the provided code relies on Chainlink's deprecated `latestAnsw. The `_createActionInfo()` function in the provided code relies on Chainlink's deprecated `latestAnswer()` function to retrieve prices for collateral and borrowing. This function does not guarantee that the returned prices are up-to-date or valid, as it does not perform any checks to ensure the data...

Vulnerable code:
```\nfunction _createActionInfo() internal view returns (ActionInfo memory) {\n    ActionInfo memory rebalanceInfo;\n\n    // Calculate prices from chainlink.\n    int256 rawCollateralPrice = strategy.collateralPriceOracle.latestAnswer();\n    rebalanceInfo.collateralPrice = rawCollateralPrice.toUint256().mul(10 ** (36 - 8 - strategy.collateralDecimalAdjustment));\n\n    int256 rawBorrowPrice = strategy.borrowPriceOracle.latestAnswer();\n    rebalanceInfo.borrowPrice = rawBorrowPrice.toUint256().mul(10 ** (36 - 8 - strategy.borrowDecimalAdjustment));\n\n    // More Code\n    // rest of code.\n}\n```
MEDIUM severity: The code base contains test code that is intended to be removed or modified before production deploy. The code base contains test code that is intended to be removed or modified before production deployment. Specifically, the `freezerAddress` and `rescuerAddress` variables are not being passed as function arguments, which may indicate that they are being used for testing purposes only.\n\nThe code s...

Vulnerable code:
```\nwhitelistingAddress = _whitelistingAddress;\nprojectAddress = _projectAddress;\nfreezerAddress = _projectAddress;  # TODO change, here only for testing\nrescuerAddress = _projectAddress;  # TODO change, here only for testing\n```
MEDIUM severity: This vulnerability occurs when a delegation period ends and tokens are automatically unlocked, witho. This vulnerability occurs when a delegation period ends and tokens are automatically unlocked, without being properly added to the `_purchased` state. Specifically, when a validator's delegation period concludes, the tokens delegated to them are unlocked, but instead of being added to the `_purchase...

Vulnerable code:
```\nif (_isPurchased[delegationId]) {\n    address holder = delegation.holder;\n    _totalDelegated[holder] += delegation.amount;\n    if (_totalDelegated[holder] >= _purchased[holder]) {\n        purchasedToUnlocked(holder);\n    }\n}\n```
MEDIUM severity: The `zAuction` contract's administrator has the ability to update the contract without warning, whic. The `zAuction` contract's administrator has the ability to update the contract without warning, which can lead to unpredictable behavior and potential security violations. This is because the administrator can make changes to the contract just before incoming transactions are processed, allowing for...

Vulnerable code:
```\nfunction SetZauction(address zauctionaddress) external onlyAdmin {\n    zauction = zauctionaddress;\n    emit ZauctionSet(zauctionaddress);\n}\n\nfunction SetAdmin(address newadmin) external onlyAdmin {\n    admin = newadmin;\n    emit AdminSet(msg.sender, newadmin);\n}\n```
MEDIUM severity: The `initialize()` function in the provided code lacks essential sanity checks, which can lead to po. The `initialize()` function in the provided code lacks essential sanity checks, which can lead to potential issues and errors. Sanity checks are crucial in ensuring the integrity and reliability of the code by verifying the validity of input data and preventing unexpected behavior.\n\nIn the provide...

Vulnerable code:
```\ntoken = _guardedToken;\nstrategy = _strategy;\nstrategyToken = IIdleCDOStrategy(_strategy).strategyToken();\nrebalancer = _rebalancer;\n```\n```\nguardian = _owner;\n```\n```\naddress _currAAStaking = AAStaking;\naddress _currBBStaking = BBStaking;\n```\n```\nidleCDO = _idleCDO;\ntranche = _trancheToken;\nrewards = _rewards;\ngovernanceRecoveryFund = _governanceRecoveryFund;\n```