Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: The `iETH.receive()` function is designed to receive ETH and is intended to be used by contracts. Ho. The `iETH.receive()` function is designed to receive ETH and is intended to be used by contracts. However, it has a limitation in that it does not support contracts executing their constructor from calling this method. This is because the `receive()` function relies on the `extcodesize` of an accoun...

Vulnerable code:
```\n/**\n * @notice receive ETH, used for flashloan repay.\n */\nreceive() external payable {\n    require(\n        msg.sender.isContract(),\n        "receive: Only can call from a contract!"\n    );\n}\n```
MEDIUM severity: The "max duration" restriction for new loans in the PublicVault system is not properly enforced. The. The "max duration" restriction for new loans in the PublicVault system is not properly enforced. The system operates on a time-based epoch system, where the duration of new loans is restricted to not exceed the end of the next epoch. However, the code allows for the addition of more than two epoch's...

Vulnerable code:
```\nfunction testBasicPublicVaultLoan() public {\n    IAstariaRouter.LienDetails memory standardLien2 = \n    IAstariaRouter.LienDetails({\n        maxAmount: 50 ether,\n        rate: (uint256(1e16) * 150) / (365 days),\n        duration: 50 days, \n        maxPotentialDebt: 50 ether\n    });    \n\n    _commitToLien({\n        vault: publicVault,\n        strategist: strategistOne,\n        strategistPK: strategistOnePK,\n        tokenContract: tokenContract,\n        tokenId: tokenId,\n        lienDetails: standardLien2, \n        amount: 10 ether,\n        isFirstLien: true\n    });\n}\n```
MEDIUM severity: The `AuraSpell#openPositionFarm` function in the AuraSpell contract fails to return all rewards to t. The `AuraSpell#openPositionFarm` function in the AuraSpell contract fails to return all rewards to the user when a user adds to an existing position. Specifically, when a user adds to an existing position, the contract burns their current position and remints a new one. However, the `WAuraPool` cont...

Vulnerable code:
```\nfor (uint i = 0; i < rewardTokens.length; i++) {\n    IERC20Upgradeable(rewardTokens[i]).safeTransfer(\n        msg.sender,\n        rewards[i]\n    );\n```\n```\nIBank.Position memory pos = bank.getCurrentPositionInfo();\nif (pos.collateralSize > 0) {\n    (uint256 pid, ) = wAuraPools.decodeId(pos.collId);\n    if (param.farmingPoolId!= pid) {\n        revert Errors.INCORRECT_PID(param.farmingPoolId);\n    }\n    if (pos.collToken!= address(wAuraPools)) {\n        revert Errors.INCORRECT_COLTOKEN(pos.collToken);\n    }\n    bank.takeCollateral(pos.collateralSize);\n    wAuraPools.burn(pos.collId, pos.collateralSize);\n    _doRefundRewards(AURA);\n}\n```
MEDIUM severity: This vulnerability allows the first depositor to manipulate the quote target value to zero, which ha. This vulnerability allows the first depositor to manipulate the quote target value to zero, which has significant implications for subsequent liquidity providers (LPs). When the initial deposit occurs, the quote target is set based on the multiplication of the shares value with a scaling factor. The...

Vulnerable code:
```\nif (totalSupply == 0) {\n    shares = quoteBalance < DecimalMath.mulFloor(baseBalance, _I_)\n       ? DecimalMath.divFloor(quoteBalance, _I_)\n        : baseBalance;\n    _BASE_TARGET_ = uint112(shares);\n    _QUOTE_TARGET_ = uint112(DecimalMath.mulFloor(shares, _I_));\n}\n```\n```\nfunction mulFloor(uint256 target, uint256 d) internal pure returns (uint256) {\n    return target * d / (10**18);\n}\n```\n```\n@review\n_QUOTE_TARGET_ = uint112(uint256(_QUOTE_TARGET_) + DecimalMath.mulFloor(uint256(_QUOTE_TARGET_), mintRatio))\n```\n```\nfunction test_StartWithZeroTarget() external {\n    vm.startPrank(tapir);\n    dai.safeTransfer(address(gsp), 1 * 1e5);\n    usdc.transfer(address(gsp), 1 * 1e5);\n    gsp.buyShares(tapir);\n\n    console.log("Base target", gsp._BASE_TARGET_());\n    console.log("Quote target", gsp._QUOTE_TARGET_());\n    console.log("Base reserve", gsp._BASE_RESERVE_());\n    console.log("Quote reserve", gsp._QUOTE_RESERVE_());\n\n    assertEq(gsp._QUOTE_TARGET_(), 0);\n\n    vm.stopPrank();\n\n    vm.startPrank(hippo);\n    dai.safeTransfer(address(gsp), 1000 * 1e18);\n    usdc.transfer(address(gsp), 10000 * 1e6);\n    gsp.buyShares(hippo);\n\n    console.log("Base target", gsp._BASE_TARGET_());\n    console.log("Quote target", gsp._QUOTE_TARGET_());\n    console.log("Base reserve", gsp._BASE_RESERVE_());\n    console.log("Quote reserve", gsp._QUOTE_RESERVE_());\n\n    assertEq(gsp._QUOTE_TARGET_(), 0);\n}\n```
MEDIUM severity: The Forta staking system's slashing mechanism allows users to submit proposals to penalize malicious. The Forta staking system's slashing mechanism allows users to submit proposals to penalize malicious actors by freezing their stakes. A single unfreeze operation, triggered by dismissing, rejecting, reverting, or executing a slashing proposal, inadvertently unfreezes all other active proposals again...

Vulnerable code:
```\nfunction dismissSlashProposal(uint256 _proposalId, string[] calldata _evidence) external onlyRole(SLASHING_ARBITER_ROLE) {\n    _transition(_proposalId, DISMISSED);\n    _submitEvidence(_proposalId, DISMISSED, _evidence);\n    _returnDeposit(_proposalId);\n    _unfreeze(_proposalId);\n}\n```\n```\nfunction rejectSlashProposal(uint256 _proposalId, string[] calldata _evidence) external onlyRole(SLASHING_ARBITER_ROLE) {\n    _transition(_proposalId, REJECTED);\n    _submitEvidence(_proposalId, REJECTED, _evidence);\n    _slashDeposit(_proposalId);\n    _unfreeze(_proposalId);\n}\n```\n```\nfunction reviewSlashProposalParameters(\n    uint256 _proposalId,\n    uint8 _subjectType,\n    uint256 _subjectId,\n    bytes32 _penaltyId,\n    string[] calldata _evidence\n) external onlyRole(SLASHING_ARBITER_ROLE) onlyInState(_proposalId, IN_REVIEW) onlyValidSlashPenaltyId(_penaltyId) onlyValidSubjectType(_subjectType) notAgencyType(_subjectType, SubjectStakeAgency.DELEGATOR) {\n    if (!subjectGateway.isRegistered(_subjectType, _subjectId)) {\n        revert NonRegisteredSubject(_subjectType, _subjectId);\n    }\n\n    _submitEvidence(_proposalId, IN_REVIEW, _evidence);\n    if (_subjectType!= proposals[_proposalId].subjectType || _subjectId!= proposals[_proposalId].subjectId) {\n        _unfreeze(_proposalId);\n        _freeze(_subjectType, _subjectId);\n    }\n```\n```\nfunction revertSlashProposal(uint256 _proposalId, string[] calldata _evidence) external {\n    _authorizeRevertSlashProposal(_proposalId);\n    _transition(_proposalId, REVERTED);\n    _submitEvidence(_proposalId, REVERTED, _evidence);\n    _unfreeze(_proposalId);\n}\n```\n```\nfunction executeSlashProposal(uint256 _proposalId) external onlyRole(SLASHER_ROLE) {\n    _transition(_proposalId, EXECUTED);\n    Proposal memory proposal = proposals[_proposalId];\n    slashingExecutor.slash(\n        proposal.subjectType,\n        proposal.subjectId,\n        getSlashedStakeValue(_proposalId),\n        proposal.proposer,\n        slashPercentToProposer\n    );\n    slashingExecutor.freeze(\n        proposal.subjectType,\n        proposal.subjectId,\n        false\n    );\n}\n```\n```\nfunction _unfreeze(uint256 _proposalId) private {\n    slashingExecutor.freeze(proposals[_proposalId].subjectType, proposals[_proposalId].subjectId, false);\n}\n```
MEDIUM severity: The vulnerability lies in the calculation of fees distribution, which is based on the ratio of a len. The vulnerability lies in the calculation of fees distribution, which is based on the ratio of a lender's individual contribution to the total amount lent. This approach leads to an unfair and unpredictable distribution of fees among lenders, particularly in scenarios where a borrower increases an e...

Vulnerable code:
```\nuint256 feesAmt = FullMath.mulDiv(feesOwed, cache.holdTokenDebt, borrowedAmount);\nloansFeesInfo[creditor][cache.holdToken] += feesAmt;\nharvestedAmt += feesAmt;\n```
MEDIUM severity: The calculation of `tickCumulatives` in the Real Wagmi protocol is vulnerable to incorrect results d. The calculation of `tickCumulatives` in the Real Wagmi protocol is vulnerable to incorrect results due to the hardcoded pool fee of `500`. This hardcoded value is used to determine the `amountOut` for slippage checking and potential reverts, but it poses several issues.\n\nFirstly, not all tokens ha...

Vulnerable code:
```\nIUniswapV3Pool(underlyingTrustedPools[500].poolAddress)\n```
MEDIUM severity: The RocketDAOProposal vulnerability is a critical issue that affects the state management of proposa. The RocketDAOProposal vulnerability is a critical issue that affects the state management of proposals in the system. Specifically, it is observed that the proposal's state is resolved in a way that prioritizes the `expired` status over the actual result, which may be `defeated`. This is achieved th...

Vulnerable code:
```\nif (getCancelled(_proposalID)) {\n    if (getCancelled(_proposalID)) {\n        return ProposalState.Cancelled;\n    }\n} else if (getExecuted(_proposalID)) {\n    return ProposalState.Executed;\n} else if (block.number >= getExpires(_proposalID)) {\n    return ProposalState.Expired;\n} else if (votesFor >= getVotesRequired(_proposalID)) {\n    return ProposalState.Succeeded;\n} else if (block.number <= getStart(_proposalID)) {\n    return ProposalState.Pending;\n} else if (block.number <= getEnd(_proposalID)) {\n    return ProposalState.Active;\n} else {\n    if (votesFor <= votesAgainst || votesFor < getVotesRequired(_proposalID)) {\n        return ProposalState.Defeated;\n    }\n}\n```
MEDIUM severity: The vulnerability in the Velo Vault's liquidation process allows for bad debt to persist even after . The vulnerability in the Velo Vault's liquidation process allows for bad debt to persist even after complete liquidation due to truncation issues. When a user's collateral is liquidated, the system checks if the proposed liquidation amount is greater than or equal to the total user collateral. Howev...

Vulnerable code:
```\nuint256 totalUserCollateral = totalCollateralValue(_collateralAddress, _loanHolder);\n\nuint256 proposedLiquidationAmount;\n\n{\n    uint256 liquidationAmount = viewLiquidatableAmount(totalUserCollateral, 1 ether, isoUSDBorrowed, liquidatableMargin);\n    require(liquidationAmount > 0, "Loan not liquidatable");\n    proposedLiquidationAmount = _calculateProposedReturnedCapital(_collateralAddress, _loanNFTs, _partialPercentage);\n    require(proposedLiquidationAmount <= liquidationAmount, "excessive liquidation suggested");\n}\n\nuint256 isoUSDreturning = proposedLiquidationAmount * LIQUIDATION_RETURN / LOAN_SCALE;\n\nif (proposedLiquidationAmount >= totalUserCollateral) {\n    // @audit bad debt cleared here\n}\n```\n```\nfunction totalCollateralValue(address _collateralAddress, address _owner) public view returns(uint256) {\n    NFTids memory userNFTs = loanNFTids[_collateralAddress][_owner];\n    IDepositReceipt depositReceipt = IDepositReceipt(_collateralAddress);\n\n    uint256 totalPooledTokens;\n    for (uint256 i = 0; i < NFT_LIMIT; i++) {\n        if (userNFTs.ids[i]!= 0) {\n            totalPooledTokens += depositReceipt.pooledTokens(userNFTs.ids[i]);\n        }\n    }\n    return (depositReceipt.priceLiquidity(totalPooledTokens));\n}\n```\n```\nfunction _calculateProposedReturnedCapital(\n    address _collateralAddress, \n    CollateralNFTs calldata _loanNFTs, \n    uint256 _partialPercentage\n) internal view returns(uint256) {\n    uint256 proposedLiquidationAmount;\n    require(_partialPercentage <= LOAN_SCALE, "partialPercentage greater than 100%");\n    for (uint256 i = 0; i < NFT_LIMIT; i++) {\n        if (_loanNFTs.slots[i] < NFT_LIMIT) {\n            if ((i == NFT_LIMIT - 1) && (_partialPercentage > 0) && (_partialPercentage < LOAN_SCALE)) {\n                proposedLiquidationAmount += \n                    (( _priceCollateral(IDepositReceipt(_collateralAddress), _loanNFTs.ids[i]) \n                    * _partialPercentage) / LOAN_SCALE);\n            } else {\n                proposedLiquidationAmount += _priceCollateral(IDepositReceipt(_collateralAddress), _loanNFTs.ids[i]);\n            }\n        }\n    }\n    return proposedLiquidationAmount;\n}\n```
MEDIUM severity: The codebase is complex and has several areas where optimization can be improved to enhance gas effi. The codebase is complex and has several areas where optimization can be improved to enhance gas efficiency and reduce storage operations. \n\nThe `_updateTopUsers`, `_updateGroupLeaders`, and `_updateLeaderboard` functions perform similar operations, involving the addition of users to a sorted set,...

Vulnerable code:
```\nuint256 _tmpIndex = _currentIndex - 1;\nuint256 _currentUserAmount = usersTeamInfo[msg.sender].stakedAmount;\n\nwhile (_currentUserAmount > usersTeamInfo[topUsers[_tmpIndex]].stakedAmount) {\n    address _tmpAddr = topUsers[_tmpIndex];\n    topUsers[_tmpIndex] = msg.sender;\n    topUsers[_tmpIndex + 1] = _tmpAddr;\n\n    if (_tmpIndex == 0) {\n        break;\n    }\n\n    _tmpIndex--;\n}\n```\n```\nfunction _getAvailableMonthForReward(address _userAddr) internal view returns (uint256) {\n    uint256 _oneMonth = 30 days;\n    uint256 _startRewardTime = getEndLMTime();\n\n    uint256 _countOfRewardedMonth = countsOfRewardedMonth[usersTeamInfo[_userAddr].teamAddr][_userAddr];\n    uint256 _numberOfMonthForReward;\n\n    for (uint256 i = _countOfRewardedMonth; i < MAX_MONTH_TO_GET_REWARD; i++) {\n        if (block.timestamp > _startRewardTime.add(_oneMonth.mul(i))) {\n            _numberOfMonthForReward++;\n        } else {\n            break;\n        }\n    }\n\n    return _numberOfMonthForReward;\n}\n```\n```\nmapping (address => mapping (address => uint256)) public countsOfRewardedMonth;\n```\n```\nstruct UserTeamInfo {\n    string teamName;\n    address teamAddr;\n\n    uint256 stakedAmount;\n    bool isNFTDistributed;\n}\n```
MEDIUM severity: The IV calculation in the system is vulnerable to manipulation due to its reliance on a single `tick. The IV calculation in the system is vulnerable to manipulation due to its reliance on a single `tickSpacing` and the use of `tickTvl` to determine the liquidity. This allows an attacker to artificially inflate the liquidity in the `tickSpacing` by depositing a large amount of liquidity, updating the...

Vulnerable code:
```\nreturn SoladyMath.sqrt((4e24 * volumeGamma0Gamma1 * scale) / (b.timestamp - a.timestamp) / tickTvl)\n```
MEDIUM severity: The `Perpetual` contract's constructor allows the deployer to specify an ERC20-compliant collateral . The `Perpetual` contract's constructor allows the deployer to specify an ERC20-compliant collateral token, along with its corresponding `decimals` value. However, the `decimals` parameter is not validated, which can lead to potential issues. Specifically, the `decimals` value provided by the deploye...

Vulnerable code:
```\nconstructor(address _collateral, uint256 decimals) public {\n    require(decimals <= MAX_DECIMALS, "decimals out of range");\n    require(_collateral!= address(0x0) || (_collateral == address(0x0) && decimals == 18), "invalid decimals");\n\n    collateral = _collateral;\n    scaler = (decimals == MAX_DECIMALS? 1 : 10** (MAX_DECIMALS - decimals)).toInt256();\n}\n```
MEDIUM severity: The vulnerability lies in the calculation of `minMarketTokenAmt` in the `deposit` function of the GM. The vulnerability lies in the calculation of `minMarketTokenAmt` in the `deposit` function of the GMXDeposit contract. The `minMarketTokenAmt` is calculated based on the user's deposit value, which is not the actual amount being deposited to GMX due to the leverage. This can lead to incorrect slippa...

Vulnerable code:
```\nfunction deposit(\n    GMXTypes.Store storage self,\n    GMXTypes.DepositParams memory dp,\n    bool isNative\n) external {\n    if (dp.token == address(self.lpToken)) {\n        // If LP token deposited\n        _dc.depositValue = self.gmxOracle.getLpTokenValue(\n            address(self.lpToken),\n            address(self.tokenA),\n            address(self.tokenA),\n            address(self.tokenB),\n            false,\n            false\n        ) * dp.amt / SAFE_MULTIPLIER;\n    } else {\n        // If tokenA or tokenB deposited\n        _dc.depositValue = GMXReader.convertToUsdValue(\n            self,\n            address(dp.token),\n            dp.amt\n        );\n    }\n\n    _alp.tokenAAmt = self.tokenA.balanceOf(address(this));\n    _alp.tokenBAmt = self.tokenB.balanceOf(address(this));\n    _alp.minMarketTokenAmt = GMXManager.calcMinMarketSlippageAmt(\n        self,\n        _dc.depositValue,\n        dp.slippage\n    );\n    _alp.executionFee = dp.executionFee;\n\n    _dc.depositKey = GMXManager.addLiquidity(\n        self,\n        _alp\n    );\n```
MEDIUM severity: The Storage Operations Optimization vulnerability is a security issue that arises from inefficient a. The Storage Operations Optimization vulnerability is a security issue that arises from inefficient and unnecessary storage operations in the DelegationController and Punisher contracts. Specifically, the `getAndUpdateValue` function in DelegationController and the `handleSlash` function in Punisher...

Vulnerable code:
```\nfor (uint i = sequence.firstUnprocessedMonth; i <= month; ++i) {\n    sequence.value = sequence.value.add(sequence.addDiff[i]).sub(sequence.subtractDiff[i]);\n    delete sequence.addDiff[i];\n    delete sequence.subtractDiff[i];\n}\n```\n```\nfunction handleSlash(address holder, uint amount) external {\n    _locked[holder] = _locked[holder].add(amount);\n}\n```
MEDIUM severity: The vulnerability arises from a rounding error in the Solidity code, specifically in the `StrategyUt. The vulnerability arises from a rounding error in the Solidity code, specifically in the `StrategyUtils._convertBPTClaimToStrategyTokens` function. This function is responsible for converting BPT claims to strategy tokens. The issue occurs when the `totalBPTHeld` is zero, which can happen during the...

Vulnerable code:
```\nint256 internal constant INTERNAL_TOKEN_PRECISION = 1e8;\nuint256 internal constant BALANCER_PRECISION = 1e18;\n```\n```\nFile: StrategyUtils.sol\n\nfunction _convertBPTClaimToStrategyTokens(StrategyContext memory context, uint256 bptClaim)\n    internal\n    pure\n    returns (uint256 strategyTokenAmount)\n{\n    if (context.vaultState.totalBPTHeld == 0) {\n        return (bptClaim * uint256(Constants.INTERNAL_TOKEN_PRECISION)) / \n            BalancerConstants.BALANCER_PRECISION;\n    }\n\n    strategyTokenAmount = (bptClaim * context.vaultState.totalStrategyTokenGlobal) / context.vaultState.totalBPTHeld;\n}\n```\n```\nstrategyTokenAmount = (bptClaim * uint256(Constants.INTERNAL_TOKEN_PRECISION)) / BalancerConstants.BALANCER_PRECISION\nstrategyTokenAmount = (bptClaim * 1e8) / 1e18\nstrategyTokenAmount = ((10 ** 10 - 1) * 1e8) / 1e18\n```\n```\nstrategyTokenAmount = (bptClaim * context.vaultState.totalStrategyTokenGlobal) / context.vaultState.totalBPTHeld;\nstrategyTokenAmount = (bptClaim * (x * 1e8)) / (y * 1e18)\n```\n```\nFile: Boosted3TokenPoolUtils.sol\n\nfunction _deposit(\n    ThreeTokenPoolContext memory poolContext,\n    StrategyContext memory strategyContext,\n    AuraStakingContext memory stakingContext,\n    BoostedOracleContext memory oracleContext,\n    uint256 deposit,\n    uint256 minBPT\n) internal returns (uint256 strategyTokensMinted) {\n    uint256 bptMinted = poolContext._joinPoolAndStake({\n        strategyContext: strategyContext,\n        stakingContext: stakingContext,\n        oracleContext: oracleContext,\n        deposit: deposit,\n        minBPT: minBPT\n    });\n\n    strategyTokensMinted = strategyContext._convertBPTClaimToStrategyTokens(bptMinted);\n\n    strategyContext.vaultState.totalBPTHeld += bptMinted;\n    strategyContext.vaultState.totalStrategyTokenGlobal += uint256(strategyTokensMinted);\n    strategyContext.vaultState.setStrategyVaultState();\n```\n```\nstrategyTokenAmount = (bptClaim * context.vaultState.totalStrategyTokenGlobal) / context.vaultState.totalBPTHeld;\nstrategyTokenAmount = (bptClaim * (10000 * 1e8)) / (10000 * 1e18);\nstrategyTokenAmount = (bptClaim * (1e12)) / (1e22);\n```
MEDIUM severity: The `purchaseSignerBondsAtAuction` function in the contract may leave a residual amount of wei (1 we. The `purchaseSignerBondsAtAuction` function in the contract may leave a residual amount of wei (1 wei in this case) in the contract if the contract balance is an odd number or if there is only one wei remaining. This occurs due to the division operation at line 271, which floors the result when divi...

Vulnerable code:
```\nif (contractEthBalance > 1) {\n    if (_wasFraud) {\n        initiator.transfer(contractEthBalance);\n    } else {\n        uint256 split = contractEthBalance / 2;\n        _d.pushFundsToKeepGroup(split);\n        initiator.transfer(split);\n    }\n}\n```
MEDIUM severity: The vulnerability in the liquidation flow of the platform's smart contract allows for a denial-of-se. The vulnerability in the liquidation flow of the platform's smart contract allows for a denial-of-service (DoS) attack, resulting in the collateral NTF becoming stuck in the contract forever. This occurs when the `loanTovalue` of an offer is extremely high, causing an arithmetic error in the `price(...

Vulnerable code:
```\nfunction testBorrowOverflow() public {\n    uint256 borrowAmount = 1e40;\n    BorrowArg[] memory borrowArgs = new BorrowArg[](1);\n    (,, uint256 loanId, ) = kairos.getParameters();\n    loanId += 1;\n\n    Offer memory offer = Offer({\n        assetToLend: money,\n        loanToValue: 1e61,\n        duration: 1,\n        expirationDate: block.timestamp + 2 hours,\n        tranche: 0,\n        collateral: getNft()\n    });\n    uint256 currentTokenId;\n\n    getFlooz(signer, money, getOfferArg(offer).amount);\n\n    {\n        OfferArg[] memory offerArgs = new OfferArg[](1);\n        currentTokenId = getJpeg(BORROWER, nft);\n        offer.collateral.id = currentTokenId;\n        offerArgs[0] = OfferArg({\n            signature: getSignature(offer),\n            amount: borrowAmount,\n            offer: offer\n        });\n        borrowArgs[0] = BorrowArg({nft: NFToken({id: currentTokenId, implem: nft}), args: offerArgs});\n    }\n\n    vm.prank(BORROWER);\n    kairos.borrow(borrowArgs);\n\n    assertEq(nft.balanceOf(BORROWER), 0);\n    assertEq(money.balanceOf(BORROWER), borrowAmount);\n    assertEq(nft.balanceOf(address(kairos)), 1);\n\n    vm.warp(block.timestamp + 1);\n    Loan memory loan = kairos.getLoan(loanId);\n    console.log("price of loanId", kairos.price(loanId));\n}\n```
MEDIUM severity: The vulnerability allows an adversary to manipulate the neutral price (NP) by frontrunning the `kick. The vulnerability allows an adversary to manipulate the neutral price (NP) by frontrunning the `kickAuction` call with a large amount of loan, thereby affecting the Most Optimistic Matching Price (MOMP). This manipulation can lead to a lower MOMP, which in turn results in a lower NP. A lower NP make...

Vulnerable code:
```\nNP_t = (1 + rate_s) * MOMP_s * TP_s * (TP_s / LUP_s) * (BI_s / BI_t)\n```\n```\nuint256 momp = _priceAt(\n    Deposits.findIndexOfSum(\n        deposits_,\n        Maths.wdiv(poolState_.debt, noOfLoans * 1e18)\n    )\n);\n```