Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: The `CoolerCallback.isCoolerCallback()` function is intended to ensure that lenders implement the `C. The `CoolerCallback.isCoolerCallback()` function is intended to ensure that lenders implement the `CoolerCallback` abstract when the `isCallback_` parameter is `true`. However, this implementation is vulnerable to bypass due to the lack of proper protection. Specifically, a malicious lender can crea...

Vulnerable code:
```\nfunction clearRequest(\n    uint256 reqID_,\n    bool repayDirect_,\n    bool isCallback_\n) external returns (uint256 loanID) {\n    Request memory req = requests[reqID_];\n\n    if (isCallback_ &&!CoolerCallback(msg.sender).isCoolerCallback()) {\n        revert NotCoolerCallback();\n    }\n\n    if (!req.active) {\n        revert Deactivated();\n    }\n\n    req.active = false;\n\n    uint256 interest = interestFor(req.amount, req.interest, req.duration);\n    uint256 collat = collateralFor(req.amount, req.loanToCollateral);\n    uint256 expiration = block.timestamp + req.duration;\n    loanID = loans.length;\n    loans.push(\n        Loan({\n            request: req,\n            amount: req.amount + interest,\n            unclaimed: 0,\n            collateral: collat,\n            expiry: expiration,\n            lender: msg.sender,\n            repayDirect: repayDirect_,\n            callback: isCallback_\n        })\n    );\n\n    requests[reqID_].active = false;\n\n    debt().safeTransferFrom(msg.sender, owner(), req.amount);\n\n    factory().newEvent(reqID_, CoolerFactory.Events.ClearRequest, 0);\n}\n```\n```\ncontract maliciousLender {\n    function isCoolerCallback() public pure returns(bool) {\n        return true;\n    }\n\n    function operation(\n        address _to,\n        uint256 reqID_\n    ) public {\n        Cooler(_to).clearRequest(reqID_, true, true);\n    }\n\n    function onDefault(uint256 loanID_, uint256 debt, uint256 collateral) public {\n    }\n}\n```\n```\nfunction approveTransfer(address to_, uint256 loanID_) external {\n    if (msg.sender!= loans[loanID_].lender) revert OnlyApproved();\n\n    // Update transfer approvals.\n    approvals[loanID_] = to_;\n}\n\nfunction transferOwnership(uint256 loanID_) external {\n    if (msg.sender!= approvals[loanID_]) revert OnlyApproved();\n\n    // Update the loan lender.\n    loans[loanID_].lender = msg.sender;\n    // Clear transfer approvals.\n    approvals[loanID_] = address(0);\n}\n```
MEDIUM severity: The `approveAndCall` function in the provided smart contract is vulnerable to an unused return param. The `approveAndCall` function in the provided smart contract is vulnerable to an unused return parameter, specifically the `bool success` variable. This variable is declared as the return type of the function, but it is never assigned a value within the function's execution. As a result, the functio...

Vulnerable code:
```\nfunction approveAndCall(address _spender, uint256 _tdtId, bytes memory _extraData) public returns (bool success) {\n    tokenRecipient spender = tokenRecipient(_spender);\n    approve(_spender, _tdtId);\n    spender.receiveApproval(msg.sender, _tdtId, address(this), _extraData);\n}\n```
MEDIUM severity: The vulnerability lies in the assumption that the `s_password` state variable, marked as `private` i. The vulnerability lies in the assumption that the `s_password` state variable, marked as `private` in the `PasswordStore` contract, is a secret and can only be accessed by the owner. However, this assumption is flawed as the data on the blockchain is inherently transparent and can be viewed by anyon...

Vulnerable code:
```\nstring private s_password;\n```\n```\nfunction test_any_non_owner_can_see_password() public {\n    string memory victimPassword = "mySecretPassword"; // Defines Victim's (Owner's) password\n    vm.startPrank(owner); // Simulates Victim's address for the next call\n    passwordStore.setPassword(victimPassword); // Victim sets their password\n\n    uint256 S_PASSWORD_STORAGE_SLOT_VALUE = 1;\n\n    bytes32 slotData = vm.load(address(passwordStore), bytes32(S_PASSWORD_STORAGE_SLOT_VALUE));\n\n    string memory anyoneCanReadPassword = string(abi.encodePacked(slotData));\n    console.log(anyoneCanReadPassword);\n}\n```
MEDIUM severity: The `isDeviatingWithBpsCheck` function in the codebase is responsible for verifying whether the devi. The `isDeviatingWithBpsCheck` function in the codebase is responsible for verifying whether the deviation between two values exceeds a defined threshold. However, the current implementation is flawed, as it calculates the deviation from the larger value to the smaller one, rather than from the mean...

Vulnerable code:
```\nfunction isDeviatingWithBpsCheck(\n    uint256 value0_,\n    uint256 value1_,\n    uint256 deviationBps_,\n    uint256 deviationMax_\n) internal pure returns (bool) {\n    if (deviationBps_ > deviationMax_) {\n        revert Deviation_InvalidDeviationBps(deviationBps_, deviationMax_);\n    }\n\n    return isDeviating(value0_, value1_, deviationBps_, deviationMax_);\n}\n\nfunction isDeviating(\n    uint256 value0_,\n    uint256 value1_,\n    uint256 deviationBps_,\n    uint256 deviationMax_\n) internal pure returns (bool) {\n    return (\n        value0_ < value1_\n           ? _isDeviating(value1_, value0_, deviationBps_, deviationMax_)\n            : _isDeviating(value0_, value1_, deviationBps_, deviationMax_)\n    );\n}\n```\n```\nfunction _isDeviating(\n    uint256 value0_,\n    uint256 value1_,\n    uint256 deviationBps_,\n    uint256 deviationMax_\n) internal pure returns (bool) {\n    return ((value0_ - value1_) * deviationMax_) / value0_ > deviationBps_;\n}\n```\n```\nif (\n    Deviation.isDeviatingWithBpsCheck(\n        baseInQuotePrice,\n        baseInQuoteTWAP,\n        params.maxDeviationBps,\n        DEVIATION_BASE\n    )\n) {\n    revert UniswapV3_PriceMismatch(address(params.pool), baseInQuoteTWAP, baseInQuotePrice);\n}\n```
MEDIUM severity: The `TOFTMarketReceiverModule::marketBorrowReceiver` flow is broken and will revert when the Magneta. The `TOFTMarketReceiverModule::marketBorrowReceiver` flow is broken and will revert when the Magnetar contract attempts to transfer ERC1155 tokens to the Market contract. This issue arises due to the lack of approval from the Magnetar contract to the Market contract through the Pearlmit contract.\n\...

Vulnerable code:
```\nfunction _extractTokens(address _from, address _token, uint256 _amount) internal returns (uint256) {\n    uint256 balanceBefore = IERC20(_token).balanceOf(address(this));\n    pearlmit.transferFromERC20(_from, address(this), address(_token), _amount);\n    uint256 balanceAfter = IERC20(_token).balanceOf(address(this));\n    if (balanceAfter <= balanceBefore) {\n        revert Magnetar_ExtractTokenFail();\n    }\n    return balanceAfter - balanceBefore;\n```\n```\nfunction _addCollateral(address from, address to, bool skim, uint256 amount, uint256 share) internal {\n    if (share == 0) {\n        share = yieldBox.toShare(collateralId, amount, false);\n    }\n    uint256 oldTotalCollateralShare = totalCollateralShare;\n    userCollateralShare[to] += share;\n    totalCollateralShare = oldTotalCollateralShare + share;\n\n    bool isErr = pearlmit.transferFromERC1155(from, address(this), address(yieldBox), collateralId, share);\n    if (isErr) {\n        revert TransferFailed();\n    }\n}\n```\n```\n## MagnetarMintCommonModule.sol\n\nfunction _lockOnTOB(\n    IOptionsLockData memory lockData,\n    IYieldBox yieldBox_,\n    uint256 fraction,\n    bool participate,\n    address user,\n    address singularityAddress\n) internal returns (uint256 tOLPTokenId) {\n    _setApprovalForYieldBox(lockData.target, yieldBox_);\n    tOLPTokenId = ITapiocaOptionLiquidityProvision(lockData.target).lock(\n        participate? address(this) : user,\n        singularityAddress,\n        lockData.lockDuration,\n        lockData.amount\n    );\n}\n\n## TapiocaOptionLiquidityProvision.sol\n\nfunction lock(\n    address _to,\n    IERC20 _singularity,\n    uint128 _lockDuration,\n    uint128 _ybShares\n) external nonReentrant returns (uint256 tokenId) {\n    // Transfer the Singularity position to this contract\n    bool isErr = pearlmit.transferFromERC1155(\n        msg.sender,\n        address(this),\n        address(yieldBox),\n        sglAssetID,\n        _ybShares\n    );\n    if (isErr) {\n        revert TransferFailed();\n    }\n```
MEDIUM severity: The `totalCoverTokens` variable is responsible for tracking the total amount of collateral required . The `totalCoverTokens` variable is responsible for tracking the total amount of collateral required to be locked in the policy book. This value should be updated whenever a new policy is purchased or an existing policy expires. However, the current implementation only updates `totalCoverTokens` when...

Vulnerable code:
```\nfunction _updateEpochsInfo() internal {\n    uint256 _totalEpochTime = block.timestamp.sub(epochStartTime);\n    uint256 _countOfPassedEpoch = _totalEpochTime.div(epochDuration);\n\n    uint256 _lastEpochUpdate = currentEpochNumber;\n    currentEpochNumber = _countOfPassedEpoch.add(1);\n\n    for (uint256 i = _lastEpochUpdate; i < currentEpochNumber; i++) {\n        totalCoverTokens = totalCoverTokens.sub(epochAmounts[i]);\n        delete epochAmounts[i];\n    }\n}\n```
MEDIUM severity: The vulnerability allows an attacker to freeze deposits and withdrawals indefinitely by exploiting a. The vulnerability allows an attacker to freeze deposits and withdrawals indefinitely by exploiting a timing-based attack on the withdrawal process. The issue arises from the fact that the `addWithdrawRequest` function only checks the user's token balance at the time of request submission, without co...

Vulnerable code:
```\nfunction addWithdrawRequest(uint256 _amountMLP, address _token) external {\n    require(isAcceptingToken(_token), "ERROR: Invalid token");\n    require(_amountMLP!= 0, "ERROR: Invalid amount");\n\n    address _withdrawer = msg.sender;\n\n    RequestBuffer storage _pendingBuffer = _requests(false);\n    RequestBuffer storage _stagedBuffer = _requests(true);\n\n    uint256 _bookedAmountMLP = _stagedBuffer.withdrawAmountPerUser[_withdrawer] + \n        _pendingBuffer.withdrawAmountPerUser[_withdrawer];\n\n    require(_bookedAmountMLP + _amountMLP <= \n        MozaicLP(mozLP).balanceOf(_withdrawer), "Withdraw amount > amount MLP");\n\n    emit WithdrawRequestAdded(_withdrawer, _token, chainId, _amountMLP);\n```\n```\nMozaicLP(mozLP).burn(request.user, _mlpToBurn)\n```
MEDIUM severity: The `totalBPTSupply` calculation in the `Boosted3TokenAuraVault` contract is flawed, as it uses `tot. The `totalBPTSupply` calculation in the `Boosted3TokenAuraVault` contract is flawed, as it uses `totalSupply` instead of `virtualSupply` to determine the amount of BPT supply in circulation. This leads to an excessive inflation of the `totalBPTSupply` value, causing the `emergencyBPTWithdrawThreshol...

Vulnerable code:
```\nFile: Boosted3TokenAuraVault.sol\n\nfunction getEmergencySettlementBPTAmount(uint256 maturity) external view returns (uint256 bptToSettle) {\n    Boosted3TokenAuraStrategyContext memory context = _strategyContext();\n    bptToSettle = context.baseStrategy._getEmergencySettlementParams({\n        maturity: maturity,\n        totalBPTSupply: IERC20(context.poolContext.basePool.basePool.pool).totalSupply()\n    });\n}\n```\n```\nFile: SettlementUtils.sol\n\nfunction _getEmergencySettlementParams(\n    StrategyContext memory strategyContext,\n    uint256 maturity,\n    uint256 totalBPTSupply\n) internal view returns (uint256 bptToSettle) {\n    StrategyVaultSettings memory settings = strategyContext.vaultSettings;\n    StrategyVaultState memory state = strategyContext.vaultState;\n\n    uint256 emergencyBPTWithdrawThreshold = settings._bptThreshold(totalBPTSupply);\n\n    if (strategyContext.vaultState.totalBPTHeld <= emergencyBPTWithdrawThreshold) {\n        revert Errors.InvalidEmergencySettlement();\n    }\n}\n```\n```\nFile: BalancerVaultStorage.sol\n\nfunction _bptThreshold(\n    StrategyVaultSettings memory strategyVaultSettings,\n    uint256 totalBPTSupply\n) internal pure returns (uint256) {\n    return (totalBPTSupply * strategyVaultSettings.maxBalancerPoolShare) / BalancerConstants.VAULT_PERCENT_BASIS;\n}\n```
MEDIUM severity: The vulnerability is related to the incorrect calculation of the StablePool BPT price. The current i. The vulnerability is related to the incorrect calculation of the StablePool BPT price. The current implementation does not consider the rates provided by the `rateProviders` when calculating the minimum price of the pool tokens. This can lead to inaccurate BPT prices and TVL calculations.\n\nThe cor...

Vulnerable code:
```\nfunction getStablePoolTokenPrice(\n    address,\n    uint8 outputDecimals_,\n    bytes calldata params_\n) external view returns (uint256) {\n    // Prevent overflow\n    if (outputDecimals_ > BASE_10_MAX_EXPONENT)\n        revert Balancer_OutputDecimalsOutOfBounds(outputDecimals_, BASE_10_MAX_EXPONENT);\n\n    address[] memory tokens;\n    uint256 poolRate; // pool decimals\n    uint8 poolDecimals;\n    bytes32 poolId;\n\n    // Get tokens in the pool from vault\n    (address[] memory tokens_,, ) = balVault.getPoolTokens(poolId);\n    tokens = tokens_;\n\n    // Get rate\n    try pool.getRate() returns (uint256 rate_) {\n        if (rate_ == 0) {\n            revert Balancer_PoolStableRateInvalid(poolId, 0);\n        }\n        poolRate = rate_;\n\n        // Calculate minimum price\n        uint256 minimumPrice; // outputDecimals_\n        {\n            for (uint256 i = 0; i < tokens.length; i++) {\n                address token = tokens[i];\n                if (token == address(0)) {\n                    revert Balancer_PoolTokenInvalid(poolId, i, token);\n                }\n\n                (uint256 price_, ) = _PRICE().getPrice(token, PRICEv2.Variant.CURRENT); // outputDecimals_\n\n                if (minimumPrice == 0) {\n                    minimumPrice = price_;\n                } else if (price_ < minimumPrice) {\n                    minimumPrice = price_;\n                }\n            }\n        }\n\n        // Calculate pool value\n        uint256 poolValue = poolRate.mulDiv(minimumPrice, 10 ** poolDecimals); // outputDecimals_\n    }\n```
MEDIUM severity: The withdrawal delay mechanism is designed to prevent protection sellers from withdrawing funds imme. The withdrawal delay mechanism is designed to prevent protection sellers from withdrawing funds immediately when a protected lending pool defaults. However, this mechanism can be bypassed by creating a withdrawal request in each cycle, allowing the user to withdraw their funds in each cycle's open s...

Vulnerable code:
```\nfunction _requestWithdrawal(uint256 _sTokenAmount) internal {\n    uint256 _sTokenBalance = balanceOf(msg.sender);\n    if (_sTokenAmount > _sTokenBalance) {\n        revert InsufficientSTokenBalance(msg.sender, _sTokenBalance);\n    }\n\n    uint256 _currentCycleIndex = poolCycleManager.getCurrentCycleIndex(address(this));\n\n    uint256 _withdrawalCycleIndex = _currentCycleIndex + 2;\n\n    WithdrawalCycleDetail storage withdrawalCycle = withdrawalCycleDetails[_withdrawalCycleIndex];\n\n    uint256 _oldRequestAmount = withdrawalCycle.withdrawalRequests[msg.sender];\n    withdrawalCycle.withdrawalRequests[msg.sender] = _sTokenAmount;\n\n    unchecked {\n        if (_oldRequestAmount > _sTokenAmount) {\n            withdrawalCycle.totalSTokenRequested -= (_oldRequestAmount - _sTokenAmount);\n        } else {\n            withdrawalCycle.totalSTokenRequested += (_sTokenAmount - _oldRequestAmount);\n        }\n    }\n\n    emit WithdrawalRequested(msg.sender, _sTokenAmount, _withdrawalCycleIndex);\n}\n```
MEDIUM severity: The vulnerability lies in the assumption made about the peg of USDC, which can lead to manipulations. The vulnerability lies in the assumption made about the peg of USDC, which can lead to manipulations in the system. Specifically, the price of USDC is used as a reference point for other tokens in the pool, as well as for evaluating the USD price of a Synthetix collateral. This assumption is made in...

Vulnerable code:
```\nfunction priceCollateralToUSD(bytes32 _currencyKey, uint256 _amount) public view override returns(uint256) {\n    return synthetixExchangeRates.effectiveValue(_currencyKey, _amount, SUSD_CODE);\n}\n```
MEDIUM severity: The ConvexSpell#closePositionFarm function in the ConvexSpell smart contract is vulnerable to liquid. The ConvexSpell#closePositionFarm function in the ConvexSpell smart contract is vulnerable to liquidity removal without slippage protection, making it susceptible to sandwich attacks. This vulnerability arises from the removal of liquidity as a single token, as seen in lines `ICurvePool(pool).remove...

Vulnerable code:
```\nICurvePool(pool).remove_liquidity_one_coin(\n    amountPosRemove,\n    int128(tokenIndex),\n    0\n)\n```
MEDIUM severity: The vulnerability allows a malicious user to evade liquidation by manipulating the pricing of the op. The vulnerability allows a malicious user to evade liquidation by manipulating the pricing of the opposite pool in the Velodrome router. This is achieved by exploiting the fact that the `priceLiquidity` function in the `DepositReceipt` contract reverts if the router routes through the wrong pool (i....

Vulnerable code:
```\nuint256 amountOut;\nbool stablePool;\n\n(amountOut, stablePool) = router.getAmountOut(HUNDRED_TOKENS, token1, USDC);\nrequire(stablePool == stable, "pricing occuring through wrong pool");\n```
MEDIUM severity: The vulnerability arises from a design flaw in the `provideSecret` function, which allows an attacke. The vulnerability arises from a design flaw in the `provideSecret` function, which allows an attacker, in this case, Dave, to intentionally reuse a secret hash that has already been used by either the borrower (Alice) or the lender (Bob). This intentional reuse enables Dave to claim the collateral w...

Vulnerable code:
```\nfunction provideSecret(bytes32 sale, bytes32 secret_) external {\n    require(sales[sale].set);\n    if (sha256(abi.encodePacked(secret_)) == secretHashes[sale].secretHashA) {\n        secretHashes[sale].secretA = secret_;\n    } else if (sha256(abi.encodePacked(secret_)) == secretHashes[sale].secretHashB) {\n        secretHashes[sale].secretB = secret_;\n    } else if (sha256(abi.encodePacked(secret_)) == secretHashes[sale].secretHashC) {\n        secretHashes[sale].secretC = secret_;\n    } else if (sha256(abi.encodePacked(secret_)) == secretHashes[sale].secretHashD) {\n        secretHashes[sale].secretD = secret_;\n    } else {\n        revert();\n    }\n}\n```\n```\nfunction accept(bytes32 sale) external {\n    require(!accepted(sale));\n    require(!off(sale));\n    require(hasSecrets(sale));\n    require(sha256(abi.encodePacked(secretHashes[sale].secretD)) == secretHashes[sale].secretHashD);\n```
MEDIUM severity: The PerpDepository.netAssetDeposits variable is susceptible to an underflow error, which can prevent. The PerpDepository.netAssetDeposits variable is susceptible to an underflow error, which can prevent users from withdrawing assets. This vulnerability arises from the discrepancy between the net asset deposits and the actual amount of assets deposited. When a user deposits assets, the net asset depo...

Vulnerable code:
```\nfunction _depositAsset(uint256 amount) private {\n    netAssetDeposits += amount;\n\n    IERC20(assetToken).approve(address(vault), amount);\n    vault.deposit(assetToken, amount);\n}\n```\n```\nfunction _withdrawAsset(uint256 amount, address to) private {\n    if (amount > netAssetDeposits) {\n        revert InsufficientAssetDeposits(netAssetDeposits, amount);\n    }\n    netAssetDeposits -= amount;\n\n    vault.withdraw(address(assetToken), amount);\n    IERC20(assetToken).transfer(to, amount);\n}\n```
MEDIUM severity: The vulnerability lies in the use of spot data when discounting, which is susceptible to manipulatio. The vulnerability lies in the use of spot data when discounting, which is susceptible to manipulation. This manipulation can occur when a user, referred to as Bob, redeems their wfCash before maturity. The `_sellfCash` function is executed, which relies on the `getPrincipalFromfCashBorrow` view func...

Vulnerable code:
```\nFile: wfCashLogic.sol\n\nfunction _sellfCash(\n    address receiver,\n    uint256 fCashToSell,\n    uint32 maxImpliedRate\n) private returns (uint256 tokensTransferred) {\n    (IERC20 token, bool isETH) = getToken(true);\n    uint256 balanceBefore = isETH? WETH.balanceOf(address(this)) : token.balanceOf(address(this));\n    uint16 currencyId = getCurrencyId();\n\n    (uint256 initialCashBalance, uint256 fCashBalance) = getBalances();\n    bool hasInsufficientfCash = fCashBalance < fCashToSell;\n\n    uint256 primeCashToWithdraw;\n\n    if (hasInsufficientfCash) {\n        (, primeCashToWithdraw,, ) = NotionalV2.getPrincipalFromfCashBorrow(\n            currencyId,\n            fCashToSell,\n            getMaturity(),\n            0,\n            block.timestamp\n        );\n        require(primeCashToWithdraw > 0, "Redeem Failed");\n\n        fCashToSell = fCashBalance;\n    }\n```
MEDIUM severity: The `RescuableV1` and `BlacklistableV1` contracts contain critical functions that are publicly acces. The `RescuableV1` and `BlacklistableV1` contracts contain critical functions that are publicly accessible and lack authentication mechanisms. This means that anyone can call these functions without being authorized, allowing for potential malicious activities such as stealing funds and blacklisting...

Vulnerable code:
```\nfunction rescue(IERC20 token, address to, uint256 amount) public virtual {\n    token.transfer(to, amount);\n}\n```\n```\nfunction blacklist(address account) public virtual {\n    _blacklisted[account] = true;\n    emit Blacklisted(account);\n}\n\nfunction unBlacklist(address account) public virtual {\n    _blacklisted[account] = false;\n    emit UnBlacklisted(account);\n}\n```
MEDIUM severity: The utilization rate calculation in the provided code is vulnerable to an arithmetic error when the . The utilization rate calculation in the provided code is vulnerable to an arithmetic error when the asset reserves exceed the cash balance. The utilization rate is defined as the ratio of borrows to the sum of borrows, cash, and reserves. However, this calculation assumes that the reserves are alway...

Vulnerable code:
```\n/**\n * @notice Calculate the utilization rate: `_borrows / (_cash + _borrows - _reserves)`\n * @param _cash Asset balance\n * @param _borrows Asset borrows\n * @param _reserves Asset reserves\n * @return Asset utilization [0, 1e18]\n */\nfunction utilizationRate(\n    uint256 _cash,\n    uint256 _borrows,\n    uint256 _reserves\n) internal pure returns (uint256) {\n    if (_borrows == 0) return 0;\n\n    return _borrows.mul(BASE).div(_cash.add(_borrows).sub(_reserves));\n}\n```
MEDIUM severity: The `VoteKickPolicy._endVote()` function is vulnerable to an underflow condition due to the potentia. The `VoteKickPolicy._endVote()` function is vulnerable to an underflow condition due to the potential for rounding errors in the calculation of `targetStakeAtRiskWei[target]`. This occurs when the `minimumStakeWei` calculation, which is used to determine the minimum amount to pay reviewers and flagg...

Vulnerable code:
```\n/**\n * Minimum amount to pay reviewers+flagger\n * That is: minimumStakeWei >= (flaggerRewardWei + flagReviewerCount * flagReviewerRewardWei) / slashingFraction\n */\nfunction minimumStakeWei() public view returns (uint) {\n    return (flaggerRewardWei + flagReviewerCount * flagReviewerRewardWei) * 1 ether / slashingFraction;\n}\n```