Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: This vulnerability occurs when the `liquidatePositionsPartyA` function attempts to update the `party. This vulnerability occurs when the `liquidatePositionsPartyA` function attempts to update the `partyBAllocatedBalances` array, which is an unsigned integer, with a value that exceeds its maximum capacity. This can happen when the profit from a position is significantly larger than the allocated bala...

Vulnerable code:
```\nFile: LiquidationFacetImpl.sol\n\nfunction liquidatePositionsPartyA(\n    address partyA,\n    uint256[] memory quoteIds\n) internal returns (bool) {\n    (bool hasMadeProfit, uint256 amount) = LibQuote.getValueOfQuoteForPartyA(\n        accountLayout.symbolsPrices[partyA][quote.symbolId].price,\n        LibQuote.quoteOpenAmount(quote),\n        quote\n    );\n\n    if (\n        accountLayout.liquidationDetails[partyA].liquidationType == LiquidationType.NORMAL\n    ) {\n        accountLayout.partyBAllocatedBalances[quote.partyB][partyA] += quote.lockedValues.cva;\n        if (hasMadeProfit) {\n            accountLayout.partyBAllocatedBalances[quote.partyB][partyA] -= amount;\n        } else {\n            accountLayout.partyBAllocatedBalances[quote.partyB][partyA] += amount;\n        }\n    } else if (\n        accountLayout.liquidationDetails[partyA].liquidationType == LiquidationType.LATE\n    ) {\n        accountLayout.partyBAllocatedBalances[quote.partyB][partyA] +=\n            quote.lockedValues.cva -\n            ((quote.lockedValues.cva * accountLayout.liquidationDetails[partyA].deficit) /\n                accountLayout.lockedBalances[partyA].cva);\n        if (hasMadeProfit) {\n            accountLayout.partyBAllocatedBalances[quote.partyB][partyA] -= amount;\n        } else {\n            accountLayout.partyBAllocatedBalances[quote.partyB][partyA] += amount;\n        }\n    } else if (\n        accountLayout.liquidationDetails[partyA].liquidationType == LiquidationType.OVERDUE\n    ) {\n        if (hasMadeProfit) {\n            accountLayout.partyBAllocatedBalances[quote.partyB][partyA] -= amount;\n        } else {\n            accountLayout.partyBAllocatedBalances[quote.partyB][partyA] +=\n                amount -\n                ((amount * accountLayout.liquidationDetails[partyA].deficit) /\n                    uint256(-accountLayout.liquidationDetails[partyA].totalUnrealizedLoss));\n        }\n    }\n```
MEDIUM severity: The `RocketDaoNodeTrustedActions` contract's member challenge process is incomplete and vulnerable t. The `RocketDaoNodeTrustedActions` contract's member challenge process is incomplete and vulnerable to exploitation. Any registered node, including untrusted ones, can initiate a challenge against a trusted DAO node by calling the `actionChallengeMake` function. The challenged node must respond by ca...

Vulnerable code:
```\nsetSettingUint('members.challenge.cooldown', 6172);\nsetSettingUint('members.challenge.window', 43204);\nsetSettingUint('members.challenge.cost', 1 ether);\n```\n```\nif the majority/all of members go offline permanently and no more proposals could be passed, a current member or a regular node can 'challenge' a DAO member's node to respond. \n\nIf it does not respond in the given window, it can be removed as a member. The one who removes the member after the challenge isn't met, must be another node other than the proposer to provide some oversight. \n\nThis should only be used in an emergency situation to recover the DAO. Members that need removing when consensus is still viable, should be done via the 'kick' method.\n```
MEDIUM severity: This vulnerability is related to unreachable code due to checked conditions in the `revealBid` funct. This vulnerability is related to unreachable code due to checked conditions in the `revealBid` function. The function is designed to ensure that the bid value is revealed only during the designated valuation period. However, the code contains a contradictory check that attempts to penalize participa...

Vulnerable code:
```\nfunction revealBid(\n    bytes32 auctionID,\n    uint256 price,\n    uint256 targetSBTAmount,\n    uint256 random\n) public override {\n    require(\n        inRevealingValuationPeriod(auctionID),\n        "it is not the time to reveal the value of bids"\n    );\n```\n```\n/*\n * @dev Penalties for revealing too early.\n * Some participants may not follow the rule and publicate their bid information before the reveal process.\n * In such a case, the bid price is overwritten by the bid with the strike price (slightly unfavored price).\n*/\n\nuint256 bidPrice = price;\n\n/*\n * @dev FOR TEST CODE RUNNING: The following if statement in L533 should be replaced by the comment out\n*/\nif (inAcceptingBidsPeriod(auctionID)) {\n    // if (false) {\n    (,, uint256 solidStrikePriceE4, ) = _getBondFromAuctionID(auctionID);\n    bidPrice = _exchangeSBT2IDOL(solidStrikePriceE4.mul(10**18));\n}\n```
MEDIUM severity: The `queueNewRewards` function is responsible for managing the distribution of rewards to whiteliste. The `queueNewRewards` function is responsible for managing the distribution of rewards to whitelisted users. When this function is called, it calculates the total amount of new rewards to be added to the queue, taking into account the existing queued rewards. However, if the accrued rewards are sign...

Vulnerable code:
```\nfunction queueNewRewards(uint256 newRewards) external onlyWhitelisted {\n    uint256 startingQueuedRewards = queuedRewards;\n    uint256 startingNewRewards = newRewards;\n\n    newRewards += startingQueuedRewards;\n\n    if (block.number >= periodInBlockFinish) {\n        notifyRewardAmount(newRewards);\n        queuedRewards = 0;\n    } else {\n        uint256 elapsedBlock = block.number - (periodInBlockFinish - durationInBlock);\n        uint256 currentAtNow = rewardRate * elapsedBlock;\n        uint256 queuedRatio = currentAtNow * 1000 / newRewards;\n\n        if (queuedRatio < newRewardRatio) {\n            notifyRewardAmount(newRewards);\n            queuedRewards = 0;\n        } else {\n            queuedRewards = newRewards;\n        }\n    }\n\n    emit QueuedRewardsUpdated(startingQueuedRewards, startingNewRewards, queuedRewards);\n\n    IERC20(rewardToken).safeTransferFrom(msg.sender, address(this), newRewards);\n}\n```
MEDIUM severity: The vulnerability in the `zAuction` and `StakingController` contracts allows for gas griefing attack. The vulnerability in the `zAuction` and `StakingController` contracts allows for gas griefing attacks by spamming off-chain fake bids. This is achieved by submitting transactions that appear to be legitimate bids, but are actually submitted by accounts that do not have the necessary funds or approva...

Vulnerable code:
```\nfunction fulfillDomainBid(\n    uint256 parentId,\n    uint256 bidAmount,\n    uint256 royaltyAmount,\n    string memory bidIPFSHash,\n    string memory name,\n    string memory metadata,\n    bytes memory signature,\n    bool lockOnCreation,\n    address recipient\n) external {\n    bytes32 recoveredBidHash = createBid(parentId, bidAmount, bidIPFSHash, name);\n    address recoveredBidder = recover(recoveredBidHash, signature);\n    require(recipient == recoveredBidder, "ZNS: bid info doesn't match/exist");\n    bytes32 hashOfSig = keccak256(abi.encode(signature));\n    require(approvedBids[hashOfSig] == true, "ZNS: has been fulfilled");\n    infinity.safeTransferFrom(recoveredBidder, controller, bidAmount);\n    uint256 id = registrar.registerDomain(parentId, name, controller, recoveredBidder);\n    registrar.setDomainMetadataUri(id, metadata);\n    registrar.setDomainRoyaltyAmount(id, royaltyAmount);\n    registrar.transferFrom(controller, recoveredBidder, id);\n    if (lockOnCreation) {\n        registrar.lockDomainMetadataForOwner(id);\n    }\n    approvedBids[hashOfSig] = false;\n    emit DomainBidFulfilled(\n        metadata,\n        name,\n        recoveredBidder,\n        id,\n        parentId\n    );\n}\n```\n```\nfunction acceptBid(bytes memory signature, uint256 rand, address bidder, uint256 bid, address nftAddress, uint256 tokenid) external {\n    address recoveredBidder = recover(toEthSignedMessageHash(keccak256(abi.encode(rand, address(this), block.chainid, bid, nftAddress, tokenid))), signature);\n    require(bidder == recoveredBidder, 'zAuction: incorrect bidder');\n    require(!randUsed[rand], 'Random nonce already used');\n    randUsed[rand] = true;\n    IERC721 nftContract = IERC721(nftAddress);\n    accountant.Exchange(bidder, msg.sender, bid);\n    nftContract.transferFrom(msg.sender, bidder, tokenid);\n    emit BidAccepted(bidder, msg.sender, bid, nftAddress, tokenid);\n}\n```
MEDIUM severity: The vulnerability allows users to withdraw their funds immediately when they are over-leveraged, whi. The vulnerability allows users to withdraw their funds immediately when they are over-leveraged, which can lead to a significant loss of collateral. This occurs when the user's total value borrowed exceeds their borrow power, which is calculated based on the user's current borrow power and the price...

Vulnerable code:
```\nfunction withdraw(address _accountAddr, address _token, uint256 _amount) external onlyAuthorized returns(uint256) {\n    require(_amount <= getDepositBalanceCurrent(_token, _accountAddr), "Insufficient balance.");\n    uint256 borrowLTV = globalConfig.tokenInfoRegistry().getBorrowLTV(_token);\n```\n```\nif (getBorrowETH(_accountAddr) <= getBorrowPower(_accountAddr)) {\n    require(\n        getBorrowETH(_accountAddr) <= getBorrowPower(_accountAddr).sub(\n            _amount.mul(globalConfig.tokenInfoRegistry().priceFromAddress(_token))\n           .mul(borrowLTV).div(Utils.getDivisor(address(globalConfig), _token)).div(100)\n        ),\n        "Insufficient collateral when withdraw."\n    );\n}\n```
MEDIUM severity: The vulnerability lies in the implementation of the safe's threshold update mechanism, where the `va. The vulnerability lies in the implementation of the safe's threshold update mechanism, where the `validSignerCount` is mistakenly used instead of the calculated `newThreshold` value. This incorrect update can lead to the safe being permanently bricked, rendering it unable to process any transactions...

Vulnerable code:
```\nif (validSignerCount <= target and validSignerCount!= currentThreshold):\n    newThreshold = validSignerCount\nelse if (validSignerCount > target and currentThreshold < target):\n    newThreshold = target\n```
MEDIUM severity: This vulnerability occurs when a stake operator attempts to manipulate their stake eligibility by st. This vulnerability occurs when a stake operator attempts to manipulate their stake eligibility by staking an amount and immediately calling the `undelegate` function. This malicious behavior allows the operator to artificially inflate their stake eligibility, potentially disrupting the integrity of...

Vulnerable code:
```\nbool notUndelegated = block.number <= operator.undelegatedAt || operator.undelegatedAt == 0;\n\nif (isAuthorized && isActive && notUndelegated) {\n    balance = operator.amount;\n}\n```
MEDIUM severity: The `withdraw` function in the perpetual contract is vulnerable to being called in the `SETTLED` sta. The `withdraw` function in the perpetual contract is vulnerable to being called in the `SETTLED` state, despite the specification stating that it should only be available in the `NORMAL` state. This is because the implementation only checks for the `!SETTLING` state, which resolves to both `NORMAL`...

Vulnerable code:
```\nfunction withdraw(uint256 amount) public {\n    withdrawFromAccount(msg.sender, amount);\n}\n```\n```\nfunction withdrawFromAccount(address payable guy, uint256 amount) private {\n    require(guy!= address(0), "invalid guy");\n    require(status!= LibTypes.Status.SETTLING, "wrong perpetual status");\n\n    uint256 currentMarkPrice = markPrice();\n    require(isSafeWithPrice(guy, currentMarkPrice), "unsafe before withdraw");\n\n    remargin(guy, currentMarkPrice);\n\n    address broker = currentBroker(guy);\n    bool forced = broker == address(amm.perpetualProxy()) || broker == address(0);\n    withdraw(guy, amount, forced);\n\n    require(isSafeWithPrice(guy, currentMarkPrice), "unsafe after withdraw");\n    require(availableMarginWithPrice(guy, currentMarkPrice) >= 0, "withdraw margin");\n}\n```\n```\nfunction withdrawFor(address payable guy, uint256 amount) public onlyWhitelisted {\n    require(status == LibTypes.Status.NORMAL, "wrong perpetual status");\n    withdrawFromAccount(guy, amount);\n}\n```
MEDIUM severity: The `_loadContext()` function in `StrategyLib` is vulnerable to an incorrect calculation of `current. The `_loadContext()` function in `StrategyLib` is vulnerable to an incorrect calculation of `currentPosition`, `minPosition`, and `maxPosition` due to the use of the wrong `pendingGlobal`. This incorrect calculation can lead to an incorrect rebalance operation.\n\nIn the `_loadContext()` function, t...

Vulnerable code:
```\nfunction _loadContext(\n    Registration memory registration\n) private view returns (MarketStrategyContext memory marketContext) {\n    // current position\n    Order memory pendingGlobal = registration.market.pendings(address(this));\n    marketContext.currentPosition = registration.market.position();\n    marketContext.currentPosition.update(pendingGlobal);\n    marketContext.minPosition = marketContext.currentAccountPosition.maker\n       .sub(\n            marketContext.currentPosition.maker\n               .sub(\n                    marketContext.currentPosition.skew().abs()\n                ).min(\n                    marketContext.closable\n                )\n        );\n    marketContext.maxPosition = marketContext.currentAccountPosition.maker\n       .add(\n            marketContext.riskParameter.makerLimit\n               .sub(\n                    marketContext.currentPosition.maker\n                )\n        );\n}\n```
MEDIUM severity: The vulnerability arises when the access to the Chainlink oracle is blocked, which can occur in exce. The vulnerability arises when the access to the Chainlink oracle is blocked, which can occur in exceptional scenarios or when multisignature entities deliberately restrict access to the price feed. This can lead to a denial-of-service (DoS) situation, where the `latestRoundData` function may revert...

Vulnerable code:
```\n(\n    uint80 _latestRoundId,\n    int256 _latestAnswer,\n    uint256 _latestTimestamp\n) = AggregatorV3Interface(_feed).latestRoundData();\n```
MEDIUM severity: The vulnerability allows an attacker to freeze profit withdrawals from V3 vaults by exploiting the `. The vulnerability allows an attacker to freeze profit withdrawals from V3 vaults by exploiting the `harvest()` function's ability to update the `lastHarvestTimestamp` variable. This can be achieved by front-running a user's `withdrawProfit()` transaction and setting `lastHarvestTimestamp` to the cur...

Vulnerable code:
```\nif (block.timestamp <= lastProfitTime) {\n    revert NYProfitTakingVault__ProfitTimeOutOfBounds();\n```\n```\nfunction harvest() external override whenNotPaused returns (uint256 callerFee) {\n    require(lastHarvestTimestamp!= block.timestamp);\n\n    uint256 harvestSeconds = lastHarvestTimestamp > 0\n       ? block.timestamp - lastHarvestTimestamp\n        : 0;\n\n    lastHarvestTimestamp = block.timestamp;\n\n    uint256 sentToVault;\n    uint256 underlyingTokenCount;\n\n    (callerFee, underlyingTokenCount, sentToVault) = _harvestCore();\n\n    emit StrategyHarvest(msg.sender, underlyingTokenCount, harvestSeconds, sentToVault);\n}\n```\n```\nfunction _harvestCore() internal override returns (uint256 callerFee, uint256 underlyingTokenCount, uint256 sentToVault) {\n    IMasterChef(SPOOKY_SWAP_FARM_V2).deposit(POOL_ID, 0);\n    _swapFarmEmissionTokens();\n    callerFee = _chargeFees();\n    underlyingTokenCount = balanceOf();\n    sentToVault = _sendYieldToVault();\n}\n```\n```\nfunction _sendYieldToVault() internal returns (uint256 sentToVault) {\n    sentToVault = IERC20Upgradeable(USDC).balanceOf(address(this));\n    if (sentToVault > 0) {\n        IERC20Upgradeable(USDC).approve(vault, sentToVault);\n        IVault(vault).depositProfitTokenForUsers(sentToVault);\n    }\n}\n```\n```\nfunction depositProfitTokenForUsers(uint256 _amount) external nonReentrant {\n    if (_amount == 0) {\n        revert NYProfitTakingVault__ZeroAmount();\n    }\n    if (block.timestamp <= lastProfitTime) {\n        revert NYProfitTakingVault__ProfitTimeOutOfBounds();\n    }\n    if (msg.sender!= strategy) {\n        revert NYProfitTakingVault__OnlyStrategy();\n    }\n    uint256 totalShares = totalSupply();\n    if (totalShares == 0) {\n        lastProfitTime = block.timestamp;\n        return;\n    }\n    accProfitTokenPerShare += ((_amount * PROFIT_TOKEN_PER_SHARE_PRECISION) / totalShares);\n    lastProfitTime = block.timestamp;\n    // Now pull in the tokens (Should have permission)\n    // We only want to pull the tokens with accounting\n    profitToken.transferFrom(strategy, address(this), _amount);\n    emit ProfitReceivedFromStrategy(_amount);\n}\n```
MEDIUM severity: The Vault Inflation Attack is a malicious exploitation of the FlatCoin protocol's deposit mechanism,. The Vault Inflation Attack is a malicious exploitation of the FlatCoin protocol's deposit mechanism, allowing an attacker to steal assets from the vault by manipulating the assets per share. The attack involves two primary steps: minting a small amount of shares and then inflating the assets per sha...

Vulnerable code:
```\nFile: StableModule.sol\n\nfunction executeDeposit(\n    address _account,\n    uint64 _executableAtTime,\n    FlatcoinStructs.AnnouncedStableDeposit calldata _announcedDeposit\n) external whenNotPaused onlyAuthorizedModule returns (uint256 _liquidityMinted) {\n    uint256 depositAmount = _announcedDeposit.depositAmount;\n\n    uint32 maxAge = _getMaxAge(_executableAtTime);\n\n    _liquidityMinted = (depositAmount * (10 ** decimals())) / stableCollateralPerShare(maxAge);\n\n    if (_liquidityMinted < _announcedDeposit.minAmountOut)\n        revert FlatcoinErrors.HighSlippage(_liquidityMinted, _announcedDeposit.minAmountOut);\n\n    _mint(_account, _liquidityMinted);\n\n    vault.updateStableCollateralTotal(int256(depositAmount));\n\n    if (totalSupply() < MIN_LIQUIDITY)\n        revert FlatcoinErrors.AmountTooSmall({amount: totalSupply(), minAmount: MIN_LIQUIDITY});\n```\n```\n_collateralPerShare = (stableBalance * (10 ** decimals())) / totalSupply\n_liquidityMinted = (depositAmount * (10 ** decimals())) / _collateralPerShare\n```
MEDIUM severity: The swap calculation when closing a position does not accurately account for shareProfitAmts, leadin. The swap calculation when closing a position does not accurately account for shareProfitAmts, leading to potential failures when attempting to repay debts. Specifically, when the operation is EXACT_IN, the swap calculation should exclude the borrowAmt from the token balance, and when the operation i...

Vulnerable code:
```\nfor (uint i = 0; i < swapParams.length; i++) {\n    // find excess amount after repay\n    uint swapAmt = swapParams[i].operation == SwapOperation.EXACT_IN\n       ? IERC20(swapParams[i].tokenIn).balanceOf(address(this)) - openTokenInfos[i].borrowAmt\n        : openTokenInfos[i].borrowAmt - IERC20(swapParams[i].tokenOut).balanceOf(address(this));\n    swapAmt = swapAmt * swapParams[i].percentSwapE18 / ONE_E18;\n    if (swapAmt == 0) {\n        revert SwapZeroAmount();\n    }\n}\n```
MEDIUM severity: The `getPositionRisk()` function is responsible for calculating the risk associated with a given pos. The `getPositionRisk()` function is responsible for calculating the risk associated with a given position. However, it appears to be vulnerable to an issue that can result in a wrong value of risk being returned. This is because the `getIsolatedCollateralValue()` function, which is a critical compon...

Vulnerable code:
```\nfunction isLiquidatable(uint256 positionId) public view returns (bool) {\n    return getPositionRisk(positionId) >=\n        banks[positions[positionId].underlyingToken].liqThreshold;\n}\n```\n```\nfunction getPositionRisk(\n    uint256 positionId\n) public view returns (uint256 risk) {\n    uint256 pv = getPositionValue(positionId);\n    uint256 ov = getDebtValue(positionId);\n    uint256 cv = getIsolatedCollateralValue(positionId);\n\n    if (\n        (cv == 0 && pv == 0 && ov == 0) || pv >= ov\n    ) {\n        risk = 0;\n    } else if (cv == 0) {\n        risk = Constants.DENOMINATOR;\n    } else {\n        risk = ((ov - pv) * Constants.DENOMINATOR) / cv;\n    }\n}\n```\n```\nfunction getIsolatedCollateralValue(\n    uint256 positionId\n) public view override returns (uint256 icollValue) {\n    Position memory pos = positions[positionId];\n\n    uint256 underlyingAmount;\n    if (_isSoftVault(pos.underlyingToken)) {\n        underlyingAmount = \n            (ICErc20(banks[pos.debtToken].bToken).exchangeRateStored() * \n                pos.underlyingVaultShare) / Constants.PRICE_PRECISION; \n    } else {\n        underlyingAmount = pos.underlyingVaultShare;\n    }\n    icollValue = oracle.getTokenValue(\n        pos.underlyingToken,\n        underlyingAmount\n    );\n}\n```\n```\ndef calculate_exchange_rate(amount, from_currency, to_currency):\n    # This function does not accrue interest before calculating the exchange rate\n    if from_currency!= 'USD':\n        amount = amount / exchange_rate(from_currency, 'USD')\n    return amount\n\ndef exchange_rate(from_currency, to_currency):\n    # This function does not accrue interest before calculating the exchange rate\n    if from_currency!= 'USD':\n        return 1 / exchange_rate(to_currency, 'USD')\n    else:\n        return 1\n\namount = 100\nfrom_currency = 'EUR'\nto_currency = 'USD'\nresult = calculate_exchange_rate(amount, from_currency, to_currency)\nprint(result)\n```
MEDIUM severity: The `ConsensusLayerFeeDispatcher` and `ExecutionLayerFeeDispatcher` contracts are vulnerable to inco. The `ConsensusLayerFeeDispatcher` and `ExecutionLayerFeeDispatcher` contracts are vulnerable to incorrect initialization due to the lack of hardcoding the auto-petrify version in the constructor. This allows an attacker to manipulate the version used for initialization, potentially leading to uninte...

Vulnerable code:
```\nconstructor(uint256 _version) {\n    VERSION_SLOT.setUint256(_version);\n}\n```\n```\nconstructor(uint256 _version) {\n    VERSION_SLOT.setUint256(_version);\n}\n\nfunction initELD(address _stakingContract) external init(1) {\n    STAKING_CONTRACT_ADDRESS_SLOT.setAddress(_stakingContract);\n}\n```
MEDIUM severity: The vulnerability lies in the signature verification process, where the chain-id is not explicitly i. The vulnerability lies in the signature verification process, where the chain-id is not explicitly included in the signed data. This allows an attacker to reuse the signed data across different chains, potentially leading to unauthorized transactions.\n\nThe `Order` struct contains a `data` field, w...

Vulnerable code:
```\nstruct Order {\n    address trader;\n    address broker;\n    address perpetual;\n    uint256 amount;\n    uint256 price;\n    bytes32 data;\n}\n```\n```\nfunction isValidSignature(\n    OrderSignature memory signature,\n    bytes32 hash,\n    address signerAddress\n)\n    internal\n    pure\n    returns (bool)\n{\n    uint8 method = uint8(signature.config[1]);\n    address recovered;\n    uint8 v = uint8(signature.config[0]);\n\n    if (method == uint8(SignatureMethod.ETH_SIGN)) {\n        recovered = ecrecover(\n            keccak256(abi.encodePacked("\x19Ethereum Signed Message: 32", hash)),\n            v,\n            signature.r,\n            signature.s\n        );\n    } else if (method == uint8(SignatureMethod.EIP712)) {\n        recovered = ecrecover(hash, v, signature.r, signature.s);\n    } else {\n        revert("invalid sign method");\n    }\n\n    return signerAddress == recovered;\n}\n```