Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: Vulnerable function: ```\nfunction _latest(\n    IMarket market,\n    address account\n) internal view returns (Position . ```\nfunction _latest(\n    IMarket market,\n    address account\n) internal view returns (Position memory latestPosition, Fixed6 latestPrice, UFixed6 closableAmount) {\n    // load parameters from the market\n    IPayoffProvider payoff = market.payoff();\n\n    // load latest settled position and p

Vulnerable code:
```\nfunction _latest(\n    IMarket market,\n    address account\n) internal view returns (Position memory latestPosition, Fixed6 latestPrice, UFixed6 closableAmount) {\n    // load parameters from the market\n    IPayoffProvider payoff = market.payoff();\n\n    // load latest settled position and price\n    uint256 latestTimestamp = market.oracle().latest().timestamp;\n    latestPosition = market.positions(account);\n    latestPrice = market.global().latestPrice;\n    UFixed6 previousMagnitude = latestPosition.magnitude();\n\n    // @audit-issue Should add:\n    // closableAmount = previousMagnitude;\n    // otherwise if no position is settled in the following loop, closableAmount incorrectly remains 0\n\n    // scan pending position for any ready-to-be-settled positions\n    Local memory local = market.locals(account);\n    for (uint256 id = local.latestId + 1; id <= local.currentId; id++) {\n\n        // load pending position\n        Position memory pendingPosition = market.pendingPositions(account, id);\n        pendingPosition.adjust(latestPosition);\n\n        // load oracle version for that position\n        OracleVersion memory oracleVersion = market.oracle().at(pendingPosition.timestamp);\n        if (address(payoff) != address(0)) oracleVersion.price = payoff.payoff(oracleVersion.price);\n\n        // virtual settlement\n        if (pendingPosition.timestamp <= latestTimestamp) {\n            if (!oracleVersion.valid) latestPosition.invalidate(pendingPosition);\n            latestPosition.update(pendingPosition);\n            if (oracleVersion.valid) latestPrice = oracleVersion.price;\n\n            previousMagnitude = latestPosition.magnitude();\n@@@         closableAmount = previousMagnitude;\n\n        // process pending positions\n        } else {\n            closableAmount = closableAmount\n                .sub(previousMagnitude.sub(pendingPosition.magnitude().min(previousMagnitude)));\n            previousMagnitude = latestPosition.magnitude();\n        }\n    }\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nquantityDeposited = \_amount;\n\nif(\_isTokenFeeCharged) {\n    // If we ch. ```\nquantityDeposited = \_amount;\n\nif(\_isTokenFeeCharged) {\n    // If we charge a fee, account for it\n    uint256 prevBal = \_checkBalance(cToken);\n    require(cToken.mint(\_amount) == 0, "cToken mint failed");\n    uint256 newBal = \_checkBalance(cToken);\n    quantityDeposited = \_min(quant

Vulnerable code:
```\nquantityDeposited = \_amount;\n\nif(\_isTokenFeeCharged) {\n    // If we charge a fee, account for it\n    uint256 prevBal = \_checkBalance(cToken);\n    require(cToken.mint(\_amount) == 0, "cToken mint failed");\n    uint256 newBal = \_checkBalance(cToken);\n    quantityDeposited = \_min(quantityDeposited, newBal.sub(prevBal));\n} else {\n    // Else just execute the mint\n    require(cToken.mint(\_amount) == 0, "cToken mint failed");\n}\n\nemit Deposit(\_bAsset, address(cToken), quantityDeposited);\n```\n
MEDIUM severity: Vulnerable function: ```\nL2_Alias = L1_Contract_Address + 0x1111000000000000000000000000000000001111. ```\nL2_Alias = L1_Contract_Address + 0x1111000000000000000000000000000000001111\n```\n

Vulnerable code:
```\nL2_Alias = L1_Contract_Address + 0x1111000000000000000000000000000000001111\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction _collectFees(uint256 idle, uint256 debt, uint256 totalSupply) internal {\n    address . ```\nfunction _collectFees(uint256 idle, uint256 debt, uint256 totalSupply) internal {\n    address sink = feeSink;\n    uint256 fees = 0;\n    uint256 shares = 0;\n    uint256 profit = 0;\n\n    // If there's no supply then there should be no assets and so nothing\n    // to actually take fees on\n

Vulnerable code:
```\nfunction _collectFees(uint256 idle, uint256 debt, uint256 totalSupply) internal {\n    address sink = feeSink;\n    uint256 fees = 0;\n    uint256 shares = 0;\n    uint256 profit = 0;\n\n    // If there's no supply then there should be no assets and so nothing\n    // to actually take fees on\n    if (totalSupply == 0) {\n        return;\n    }\n\n    uint256 currentNavPerShare = ((idle + debt) * MAX_FEE_BPS) / totalSupply;\n    uint256 effectiveNavPerShareHighMark = navPerShareHighMark;\n\n    if (currentNavPerShare > effectiveNavPerShareHighMark) {\n        // Even if we aren't going to take the fee (haven't set a sink)\n        // We still want to calculate so we can emit for off-chain analysis\n        profit = (currentNavPerShare - effectiveNavPerShareHighMark) * totalSupply;\n        fees = profit.mulDiv(performanceFeeBps, (MAX_FEE_BPS ** 2), Math.Rounding.Up);\n        if (fees > 0 && sink != address(0)) {\n            // Calculated separate from other mints as normal share mint is round down\n            shares = _convertToShares(fees, Math.Rounding.Up);\n            _mint(sink, shares);\n            emit Deposit(address(this), sink, fees, shares);\n        }\n        // Set our new high water mark, the last nav/share height we took fees\n        navPerShareHighMark = currentNavPerShare;\n        navPerShareHighMarkTimestamp = block.timestamp;\n        emit NewNavHighWatermark(currentNavPerShare, block.timestamp);\n    }\n    emit FeeCollected(fees, sink, shares, profit, idle, debt);\n}\n```\n
HIGH severity: Vulnerable function: ```\nfunction getTotalBorrowingFees(DataStore dataStore, address market, address longToken, address . ```\nfunction getTotalBorrowingFees(DataStore dataStore, address market, address longToken, address shortToken, bool isLong) internal view returns (uint256) {\n    uint256 openInterest = getOpenInterest(dataStore, market, longToken, shortToken, isLong);\n    uint256 cumulativeBorrowingFactor = getCu

Vulnerable code:
```\nfunction getTotalBorrowingFees(DataStore dataStore, address market, address longToken, address shortToken, bool isLong) internal view returns (uint256) {\n    uint256 openInterest = getOpenInterest(dataStore, market, longToken, shortToken, isLong);\n    uint256 cumulativeBorrowingFactor = getCumulativeBorrowingFactor(dataStore, market, isLong);\n    uint256 totalBorrowing = getTotalBorrowing(dataStore, market, isLong);\n    return openInterest * cumulativeBorrowingFactor - totalBorrowing;\n}\n```\n
MEDIUM severity: Vulnerable function: ```\ncontract OracleFactory is IOracleFactory, Factory {\n// rest of code\n    function update(bytes. ```\ncontract OracleFactory is IOracleFactory, Factory {\n// rest of code\n    function update(bytes32 id, IOracleProviderFactory factory) external onlyOwner {\n        if (!factories[factory]) revert OracleFactoryNotRegisteredError();\n        if (oracles[id] == IOracleProvider(address(0))) revert 

Vulnerable code:
```\ncontract OracleFactory is IOracleFactory, Factory {\n// rest of code\n    function update(bytes32 id, IOracleProviderFactory factory) external onlyOwner {\n        if (!factories[factory]) revert OracleFactoryNotRegisteredError();\n        if (oracles[id] == IOracleProvider(address(0))) revert OracleFactoryNotCreatedError();\n\n        IOracleProvider oracleProvider = factory.oracles(id);\n        if (oracleProvider == IOracleProvider(address(0))) revert OracleFactoryInvalidIdError();\n\n        IOracle oracle = IOracle(address(oracles[id]));\n      oracle.update(oracleProvider);\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\n        address priceQuoteToken = _getPriceQuoteToken(tokenIn, tokenOut);\n. ```\n        address priceQuoteToken = _getPriceQuoteToken(tokenIn, tokenOut);\n        price = oracle.getLatestPrice(priceQuoteToken);\n        _checkPrice(priceQuoteToken, price);\n\n        feeNumerator = isBuy ? pair.buyFee : pair.sellFee;\n        feeToken = IERC20Token(priceQuoteToken == token

Vulnerable code:
```\n        address priceQuoteToken = _getPriceQuoteToken(tokenIn, tokenOut);\n        price = oracle.getLatestPrice(priceQuoteToken);\n        _checkPrice(priceQuoteToken, price);\n\n        feeNumerator = isBuy ? pair.buyFee : pair.sellFee;\n        feeToken = IERC20Token(priceQuoteToken == tokenIn ? tokenOut : tokenIn);\n\n        SwapRequest memory request;\n        request.tokenIn = tokenIn;\n        request.tokenOut = tokenOut;\n        request.amountType = amountType;\n        request.amount = amount;\n        request.feeNumerator = feeNumerator;\n        request.feeBase = tokenManager.SWAP_FEE_BASE();\n        request.feeToken = address(feeToken);\n        request.price = price;\n        request.priceBase = 10 ** oracle.decimals();\n        request.quoteToken = priceQuoteToken;\n\n        (amountIn, amountOut, fee) = _calculateSwapResult(request);\n```\n
MEDIUM severity: Vulnerable function: ```\nFile: MainVault.sol\n  function deposit(\n    uint256 _amount,\n    address _receiver\n  ) exte. ```\nFile: MainVault.sol\n  function deposit(\n    uint256 _amount,\n    address _receiver\n  ) external nonReentrant onlyWhenVaultIsOn returns (uint256 shares) {\n    if (training) {\n      require(whitelist[msg.sender]);\n      uint256 balanceSender = (balanceOf(msg.sender) * exchangeRate) / (10 *

Vulnerable code:
```\nFile: MainVault.sol\n  function deposit(\n    uint256 _amount,\n    address _receiver\n  ) external nonReentrant onlyWhenVaultIsOn returns (uint256 shares) {\n    if (training) {\n      require(whitelist[msg.sender]);\n      uint256 balanceSender = (balanceOf(msg.sender) * exchangeRate) / (10 ** decimals());\n      require(_amount + balanceSender <= maxTrainingDeposit);\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction wpkhSpendSighash(\n    bytes memory \_outpoint,  // 36 byte UTXO id\n    bytes20 \_inp. ```\nfunction wpkhSpendSighash(\n    bytes memory \_outpoint,  // 36 byte UTXO id\n    bytes20 \_inputPKH,       // 20 byte hash160\n    bytes8 \_inputValue,      // 8-byte LE\n    bytes8 \_outputValue,     // 8-byte LE\n    bytes memory \_outputScript    // lenght-prefixed output script\n) internal

Vulnerable code:
```\nfunction wpkhSpendSighash(\n    bytes memory \_outpoint,  // 36 byte UTXO id\n    bytes20 \_inputPKH,       // 20 byte hash160\n    bytes8 \_inputValue,      // 8-byte LE\n    bytes8 \_outputValue,     // 8-byte LE\n    bytes memory \_outputScript    // lenght-prefixed output script\n) internal pure returns (bytes32) {\n    // Fixes elements to easily make a 1-in 1-out sighash digest\n    // Does not support timelocks\n    bytes memory \_scriptCode = abi.encodePacked(\n        hex"1976a914",  // length, dup, hash160, pkh\_length\n        \_inputPKH,\n        hex"88ac");  // equal, checksig\n    bytes32 \_hashOutputs = abi.encodePacked(\n        \_outputValue,  // 8-byte LE\n        \_outputScript).hash256();\n    bytes memory \_sighashPreimage = abi.encodePacked(\n        hex"01000000",  // version\n        \_outpoint.hash256(),  // hashPrevouts\n        hex"8cb9012517c817fead650287d61bdd9c68803b6bf9c64133dcab3e65b5a50cb9",  // hashSequence(00000000)\n        \_outpoint,  // outpoint\n        \_scriptCode,  // p2wpkh script code\n        \_inputValue,  // value of the input in 8-byte LE\n        hex"00000000",  // input nSequence\n        \_hashOutputs,  // hash of the single output\n        hex"00000000",  // nLockTime\n        hex"01000000"  // SIGHASH\_ALL\n    );\n    return \_sighashPreimage.hash256();\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction initialize(address pauserAddress) public virtual initializer {\n \_\_ERC20\_init("pSTA. ```\nfunction initialize(address pauserAddress) public virtual initializer {\n \_\_ERC20\_init("pSTAKE Token", "PSTAKE");\n \_\_AccessControl\_init();\n \_\_Pausable\_init();\n \_setupRole(DEFAULT\_ADMIN\_ROLE, \_msgSender());\n \_setupRole(PAUSER\_ROLE, pauserAddress);\n // PSTAKE IS A SIMPLE ERC20

Vulnerable code:
```\nfunction initialize(address pauserAddress) public virtual initializer {\n \_\_ERC20\_init("pSTAKE Token", "PSTAKE");\n \_\_AccessControl\_init();\n \_\_Pausable\_init();\n \_setupRole(DEFAULT\_ADMIN\_ROLE, \_msgSender());\n \_setupRole(PAUSER\_ROLE, pauserAddress);\n // PSTAKE IS A SIMPLE ERC20 TOKEN HENCE 18 DECIMAL PLACES\n \_setupDecimals(18);\n // pre-allocate some tokens to an admin address which will air drop PSTAKE tokens\n // to each of holder contracts. This is only for testnet purpose. in Mainnet, we\n // will use a vesting contract to allocate tokens to admin in a certain schedule\n \_mint(\_msgSender(), 5000000000000000000000000);\n}\n```\n
HIGH severity: Vulnerable function: ```\n    function _nonReentrantAfter() internal virtual {\n    // By storing the original value once. ```\n    function _nonReentrantAfter() internal virtual {\n    // By storing the original value once again, a refund is triggered \n             (see // https://eips.ethereum.org/EIPS/eip-2200)\n        _reentrancyStatus = false;\n     }\n```\n

Vulnerable code:
```\n    function _nonReentrantAfter() internal virtual {\n    // By storing the original value once again, a refund is triggered \n             (see // https://eips.ethereum.org/EIPS/eip-2200)\n        _reentrancyStatus = false;\n     }\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction _castVote(address _voter, uint256 _proposalId, uint8 _support) internal returns (uint). ```\nfunction _castVote(address _voter, uint256 _proposalId, uint8 _support) internal returns (uint) {\n    // Only Active proposals can be voted on\n    if (state(_proposalId) != ProposalState.Active) revert InvalidStatus();\n    \n    // Only valid values for _support are 0 (against), 1 (for), and

Vulnerable code:
```\nfunction _castVote(address _voter, uint256 _proposalId, uint8 _support) internal returns (uint) {\n    // Only Active proposals can be voted on\n    if (state(_proposalId) != ProposalState.Active) revert InvalidStatus();\n    \n    // Only valid values for _support are 0 (against), 1 (for), and 2 (abstain)\n    if (_support > 2) revert InvalidInput();\n\n    Proposal storage proposal = proposals[_proposalId];\n\n    // If the voter has already voted, revert        \n    Receipt storage receipt = proposal.receipts[_voter];\n    if (receipt.hasVoted) revert AlreadyVoted();\n\n    // Calculate the number of votes a user is able to cast\n    // This takes into account delegation and community voting power\n    uint24 votes = (staking.getVotes(_voter)).toUint24();\n\n    // Update the proposal's total voting records based on the votes\n    if (_support == 0) {\n        proposal.againstVotes = proposal.againstVotes + votes;\n    } else if (_support == 1) {\n        proposal.forVotes = proposal.forVotes + votes;\n    } else if (_support == 2) {\n        proposal.abstainVotes = proposal.abstainVotes + votes;\n    }\n\n    // Update the user's receipt for this proposal\n    receipt.hasVoted = true;\n    receipt.support = _support;\n    receipt.votes = votes;\n\n    // Make these updates after the vote so it doesn't impact voting power for this vote.\n    ++totalCommunityScoreData.votes;\n\n    // We can update the total community voting power with no check because if you can vote, \n    // it means you have votes so you haven't delegated.\n    ++userCommunityScoreData[_voter].votes;\n\n    return votes;\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nif (vAssets.borrowAsset == FTM) {\n require(msg.value >= debtTotal, Errors.. ```\nif (vAssets.borrowAsset == FTM) {\n require(msg.value >= debtTotal, Errors.VL\_AMOUNT\_ERROR);\n} else {\n```\n

Vulnerable code:
```\nif (vAssets.borrowAsset == FTM) {\n require(msg.value >= debtTotal, Errors.VL\_AMOUNT\_ERROR);\n} else {\n```\n
MEDIUM severity: Vulnerable function: ```\nmodifier onlyAuthorized() {\n    require(\n        ((msg.sender == L2CrossD. ```\nmodifier onlyAuthorized() {\n    require(\n        ((msg.sender == L2CrossDomainMessenger &&\n            OptimismL2Wrapper.messageSender() == positionHandlerL1) ||\n            msg.sender == keeper),\n        "ONLY\_AUTHORIZED"\n    );\n    \_;\n}\n```\n

Vulnerable code:
```\nmodifier onlyAuthorized() {\n    require(\n        ((msg.sender == L2CrossDomainMessenger &&\n            OptimismL2Wrapper.messageSender() == positionHandlerL1) ||\n            msg.sender == keeper),\n        "ONLY\_AUTHORIZED"\n    );\n    \_;\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction \_capFeeAmount(uint256 \_amount) internal view returns (uint256 \_capped, uint256 \_re. ```\nfunction \_capFeeAmount(uint256 \_amount) internal view returns (uint256 \_capped, uint256 \_retained)\n{\n \_retained = 0;\n uint256 \_limit = \_calcMaxRewardTransferAmount();\n if (\_amount > \_limit) {\n  \_amount = \_limit;\n  \_retained = \_amount.sub(\_limit);\n }\n return (\_amount, \_re

Vulnerable code:
```\nfunction \_capFeeAmount(uint256 \_amount) internal view returns (uint256 \_capped, uint256 \_retained)\n{\n \_retained = 0;\n uint256 \_limit = \_calcMaxRewardTransferAmount();\n if (\_amount > \_limit) {\n  \_amount = \_limit;\n  \_retained = \_amount.sub(\_limit);\n }\n return (\_amount, \_retained);\n}\n```\n
MEDIUM severity: Vulnerable function: ```\n        minTimestamp_ = _verifyValidatorSignatures(\n            msg.sender. ```\n        minTimestamp_ = _verifyValidatorSignatures(\n            msg.sender,\n            collateral_,\n            retrievalIds_,\n            metadataHash_,\n            validators_,\n            timestamps_,\n            signatures_\n        );\n        // rest of code\n        _updateCollat

Vulnerable code:
```\n        minTimestamp_ = _verifyValidatorSignatures(\n            msg.sender,\n            collateral_,\n            retrievalIds_,\n            metadataHash_,\n            validators_,\n            timestamps_,\n            signatures_\n        );\n        // rest of code\n        _updateCollateral(msg.sender, safeCollateral_, minTimestamp_);\n        // rest of code\n```\n
MEDIUM severity: Vulnerable function: ```\n/\*\*\n \* @notice Update each iToken's distribution speed according to current global speed\n . ```\n/\*\*\n \* @notice Update each iToken's distribution speed according to current global speed\n \* @dev Only EOA can call this function\n \*/\nfunction updateDistributionSpeed() public override {\n    require(msg.sender == tx.origin, "only EOA can update speeds");\n    require(!paused, "Can not 

Vulnerable code:
```\n/\*\*\n \* @notice Update each iToken's distribution speed according to current global speed\n \* @dev Only EOA can call this function\n \*/\nfunction updateDistributionSpeed() public override {\n    require(msg.sender == tx.origin, "only EOA can update speeds");\n    require(!paused, "Can not update speeds when paused");\n\n    // Do the actual update\n    \_updateDistributionSpeed();\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nuint112 virtualEth = type(uint112).max;\nuint112 bootstrapEth = type(uint11. ```\nuint112 virtualEth = type(uint112).max;\nuint112 bootstrapEth = type(uint112).max;\nuint112 initialEth = type(uint112).max;\nuint112 initialTokenMatch = type(uint112).max;\n```\n

Vulnerable code:
```\nuint112 virtualEth = type(uint112).max;\nuint112 bootstrapEth = type(uint112).max;\nuint112 initialEth = type(uint112).max;\nuint112 initialTokenMatch = type(uint112).max;\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction viewNumeraireAmount (address \_assim, uint256 \_amt) internal returns (int128 amt\_) {. ```\nfunction viewNumeraireAmount (address \_assim, uint256 \_amt) internal returns (int128 amt\_) {\n\n    // amount\_ = IAssimilator(\_assim).viewNumeraireAmount(\_amt); // for production\n\n    bytes memory data = abi.encodeWithSelector(iAsmltr.viewNumeraireAmount.selector, \_amt); // for develop

Vulnerable code:
```\nfunction viewNumeraireAmount (address \_assim, uint256 \_amt) internal returns (int128 amt\_) {\n\n    // amount\_ = IAssimilator(\_assim).viewNumeraireAmount(\_amt); // for production\n\n    bytes memory data = abi.encodeWithSelector(iAsmltr.viewNumeraireAmount.selector, \_amt); // for development\n\n    amt\_ = abi.decode(\_assim.delegate(data), (int128)); // for development\n\n}\n```\n
HIGH severity: Vulnerable function: ```\nfunction withdrawFromInsuranceFund(uint256 rawAmount) public onlyWhitelistAdmin {\n    require(. ```\nfunction withdrawFromInsuranceFund(uint256 rawAmount) public onlyWhitelistAdmin {\n    require(rawAmount > 0, "invalid amount");\n    require(insuranceFundBalance > 0, "insufficient funds");\n    require(rawAmount <= insuranceFundBalance.toUint256(), "insufficient funds");\n\n    int256 wadAmou

Vulnerable code:
```\nfunction withdrawFromInsuranceFund(uint256 rawAmount) public onlyWhitelistAdmin {\n    require(rawAmount > 0, "invalid amount");\n    require(insuranceFundBalance > 0, "insufficient funds");\n    require(rawAmount <= insuranceFundBalance.toUint256(), "insufficient funds");\n\n    int256 wadAmount = toWad(rawAmount);\n    insuranceFundBalance = insuranceFundBalance.sub(wadAmount);\n    withdrawFromProtocol(msg.sender, rawAmount);\n\n    require(insuranceFundBalance >= 0, "negtive insurance fund");\n\n    emit UpdateInsuranceFund(insuranceFundBalance);\n}\n```\n
MEDIUM severity: Vulnerable function: ```\n    function _cancelOrderAccounting(OrderRequest calldata orderRequest, bytes32 orderId, OrderS. ```\n    function _cancelOrderAccounting(OrderRequest calldata orderRequest, bytes32 orderId, OrderState memory orderState)\n        internal\n        virtual\n        override\n    {\n        // rest of code\n\n        uint256 refund = orderState.remainingOrder + feeState.remainingPercentageFees;\n

Vulnerable code:
```\n    function _cancelOrderAccounting(OrderRequest calldata orderRequest, bytes32 orderId, OrderState memory orderState)\n        internal\n        virtual\n        override\n    {\n        // rest of code\n\n        uint256 refund = orderState.remainingOrder + feeState.remainingPercentageFees;\n\n        // rest of code\n\n        if (refund + feeState.feesEarned == orderRequest.quantityIn) {\n            _closeOrder(orderId, orderRequest.paymentToken, 0);\n            // Refund full payment\n            refund = orderRequest.quantityIn;\n        } else {\n            // Otherwise close order and transfer fees\n            _closeOrder(orderId, orderRequest.paymentToken, feeState.feesEarned);\n        }\n\n\n        // Return escrow\n        IERC20(orderRequest.paymentToken).safeTransfer(orderRequest.recipient, refund);\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction priceCollateralToUSD(bytes32 _currencyKey, uint256 _amount) public view override retur. ```\nfunction priceCollateralToUSD(bytes32 _currencyKey, uint256 _amount) public view override returns(uint256){\n        //The LiquidityPool associated with the LP Token is used for pricing\n    ILiquidityPoolAvalon LiquidityPool = ILiquidityPoolAvalon(collateralBook.liquidityPoolOf(_currencyKey));

Vulnerable code:
```\nfunction priceCollateralToUSD(bytes32 _currencyKey, uint256 _amount) public view override returns(uint256){\n        //The LiquidityPool associated with the LP Token is used for pricing\n    ILiquidityPoolAvalon LiquidityPool = ILiquidityPoolAvalon(collateralBook.liquidityPoolOf(_currencyKey));\n    //we have already checked for stale greeks so here we call the basic price function.\n    uint256 tokenPrice = LiquidityPool.getTokenPrice();\n    uint256 withdrawalFee = _getWithdrawalFee(LiquidityPool);\n    uint256 USDValue  = (_amount * tokenPrice) / LOAN_SCALE;\n    //we remove the Liquidity Pool withdrawalFee\n    //as there's no way to remove the LP position without paying this.\n    uint256 USDValueAfterFee = USDValue * (LOAN_SCALE- withdrawalFee)/LOAN_SCALE;\n    return(USDValueAfterFee);\n}\n```\n