Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: Vulnerable function: ```\nfunction rescue(IERC20 token, address to, uint256 amount) public virtual {\n```\n. ```\nfunction rescue(IERC20 token, address to, uint256 amount) public virtual {\n```\n

Vulnerable code:
```\nfunction rescue(IERC20 token, address to, uint256 amount) public virtual {\n```\n
MEDIUM severity: Vulnerable function: ```\nelse{\n    //swap token1 for token0\n    swap = uint256(swapAmount);\n    I. ```\nelse{\n    //swap token1 for token0\n    swap = uint256(swapAmount);\n    IHypervisor(pos).token0().transferFrom(msg.sender, address(this), deposit0+swap);\n\n    amountOut = router.exactInput(\n        ISwapRouter.ExactInputParams(\n            path,\n            address(this),\n            bl

Vulnerable code:
```\nelse{\n    //swap token1 for token0\n    swap = uint256(swapAmount);\n    IHypervisor(pos).token0().transferFrom(msg.sender, address(this), deposit0+swap);\n\n    amountOut = router.exactInput(\n        ISwapRouter.ExactInputParams(\n            path,\n            address(this),\n            block.timestamp + swapLife,\n            swap,\n            deposit1\n        )\n    );     \n}\n\nrequire(amountOut > 0, "Swap failed");\n\nif (positions[pos].version < 2) {\n  // requires lp token transfer from proxy to msg.sender\n  shares = IHypervisor(pos).deposit(deposit0, deposit1, address(this));\n  IHypervisor(pos).transfer(to, shares);\n}\n```\n
HIGH severity: Vulnerable function: ```\n           if ((lockEndTime - weekCursor) > (minLockDurationForReward)) {\n. ```\n           if ((lockEndTime - weekCursor) > (minLockDurationForReward)) {\n            toDistribute +=\n        (balanceOf * tokensPerWeek[weekCursor]) / veSupply[weekCursor];\n        weekCursor += WEEK;\n       }\n```\n

Vulnerable code:
```\n           if ((lockEndTime - weekCursor) > (minLockDurationForReward)) {\n            toDistribute +=\n        (balanceOf * tokensPerWeek[weekCursor]) / veSupply[weekCursor];\n        weekCursor += WEEK;\n       }\n```\n
MEDIUM severity: Vulnerable function: ```\nFile: symmio-core\contracts\facets\PartyB\PartyBFacetImpl.sol\n    function chargeFundingRate(\. ```\nFile: symmio-core\contracts\facets\PartyB\PartyBFacetImpl.sol\n    function chargeFundingRate(\n        address partyA,\n        uint256[] memory quoteIds,\n        int256[] memory rates,\n        PairUpnlSig memory upnlSig\n    ) internal {\n        LibMuon.verifyPairUpnl(upnlSig, msg.sender, 

Vulnerable code:
```\nFile: symmio-core\contracts\facets\PartyB\PartyBFacetImpl.sol\n    function chargeFundingRate(\n        address partyA,\n        uint256[] memory quoteIds,\n        int256[] memory rates,\n        PairUpnlSig memory upnlSig\n    ) internal {\n        LibMuon.verifyPairUpnl(upnlSig, msg.sender, partyA);\n        require(quoteIds.length == rates.length, "PartyBFacet: Length not match");\n        int256 partyBAvailableBalance = LibAccount.partyBAvailableBalanceForLiquidation(\n            upnlSig.upnlPartyB,\n            msg.sender,\n            partyA\n        );\n        int256 partyAAvailableBalance = LibAccount.partyAAvailableBalanceForLiquidation(\n            upnlSig.upnlPartyA,\n            partyA\n        );\n        uint256 epochDuration;\n        uint256 windowTime;\n        for (uint256 i = 0; i < quoteIds.length; i++) {\n// rest of code// rest of code//quoteIds is empty array, so code is never executed.\n        }\n        require(partyAAvailableBalance >= 0, "PartyBFacet: PartyA will be insolvent");\n        require(partyBAvailableBalance >= 0, "PartyBFacet: PartyB will be insolvent");\n        AccountStorage.layout().partyBNonces[msg.sender][partyA] += 1;\n394:->       AccountStorage.layout().partyANonces[partyA] += 1;\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\n   function setApprovalForERC20(\n        IERC20 erc20Contract,\n        address to,\n        u. ```\n   function setApprovalForERC20(\n        IERC20 erc20Contract,\n        address to,\n        uint256 amount\n    ) external onlyClubOwner {\n        erc20Contract.approve(to, amount);\n    }\n```\n

Vulnerable code:
```\n   function setApprovalForERC20(\n        IERC20 erc20Contract,\n        address to,\n        uint256 amount\n    ) external onlyClubOwner {\n        erc20Contract.approve(to, amount);\n    }\n```\n
HIGH severity: Vulnerable function: ```\ndef _change_gauge_weight(addr: address, weight: uint256):\n    # Change gau. ```\ndef _change_gauge_weight(addr: address, weight: uint256):\n    # Change gauge weight\n    # Only needed when testing in reality\n    gauge_type: int128 = self.gauge_types_[addr] - 1\n    old_gauge_weight: uint256 = self._get_weight(addr)\n    type_weight: uint256 = self._get_type_weight(gauge_t

Vulnerable code:
```\ndef _change_gauge_weight(addr: address, weight: uint256):\n    # Change gauge weight\n    # Only needed when testing in reality\n    gauge_type: int128 = self.gauge_types_[addr] - 1\n    old_gauge_weight: uint256 = self._get_weight(addr)\n    type_weight: uint256 = self._get_type_weight(gauge_type)\n    old_sum: uint256 = self._get_sum(gauge_type)\n    _total_weight: uint256 = self._get_total()\n    next_time: uint256 = (block.timestamp + WEEK) / WEEK * WEEK\n\n    self.points_weight[addr][next_time].bias = weight\n    self.time_weight[addr] = next_time\n\n    new_sum: uint256 = old_sum + weight - old_gauge_weight\n    self.points_sum[gauge_type][next_time].bias = new_sum\n    self.time_sum[gauge_type] = next_time\n\n    _total_weight = _total_weight + new_sum * type_weight - old_sum * type_weight\n    self.points_total[next_time] = _total_weight\n    self.time_total = next_time\n\n    log NewGaugeWeight(addr, block.timestamp, weight, _total_weight)\n```\n
HIGH severity: Vulnerable function: ```\nuint128 virtualAmountDelta = uint128( ( amount \* poolDeposit.multiplier ) . ```\nuint128 virtualAmountDelta = uint128( ( amount \* poolDeposit.multiplier ) / SCALE\_FACTOR );\n\n// Effects\npoolDeposit.amount -= amount;\nuser.rewardDebt = user.rewardDebt - toSigned128(user.virtualAmount \* pool.accTribePerShare) / toSigned128(ACC\_TRIBE\_PRECISION);\nuser.virtualAmount -= v

Vulnerable code:
```\nuint128 virtualAmountDelta = uint128( ( amount \* poolDeposit.multiplier ) / SCALE\_FACTOR );\n\n// Effects\npoolDeposit.amount -= amount;\nuser.rewardDebt = user.rewardDebt - toSigned128(user.virtualAmount \* pool.accTribePerShare) / toSigned128(ACC\_TRIBE\_PRECISION);\nuser.virtualAmount -= virtualAmountDelta;\npool.virtualTotalSupply -= virtualAmountDelta;\n```\n
MEDIUM severity: Vulnerable function: ```\nFile: Tranche.sol\n    /// @notice Pause issue, collect and updateUnclaimedYield\n    /// @dev . ```\nFile: Tranche.sol\n    /// @notice Pause issue, collect and updateUnclaimedYield\n    /// @dev only callable by management\n    function pause() external onlyManagement {\n        _pause();\n    }\n\n    /// @notice Unpause issue, collect and updateUnclaimedYield\n    /// @dev only callable by 

Vulnerable code:
```\nFile: Tranche.sol\n    /// @notice Pause issue, collect and updateUnclaimedYield\n    /// @dev only callable by management\n    function pause() external onlyManagement {\n        _pause();\n    }\n\n    /// @notice Unpause issue, collect and updateUnclaimedYield\n    /// @dev only callable by management\n    function unpause() external onlyManagement {\n        _unpause();\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\nif (blockInfo.l2BlockTimestamp >= block.timestamp) {\n revert BlockTimestam. ```\nif (blockInfo.l2BlockTimestamp >= block.timestamp) {\n revert BlockTimestampError();\n}\n```\n

Vulnerable code:
```\nif (blockInfo.l2BlockTimestamp >= block.timestamp) {\n revert BlockTimestampError();\n}\n```\n
MEDIUM severity: Vulnerable function: ```\n  it('PoC user will lose extra deposited tokens', async () => {\n\n    let . ```\n  it('PoC user will lose extra deposited tokens', async () => {\n\n    let user = accounts[1]\n    let initialUserSDLBalance = await sdlToken.balanceOf(user);\n\n    // User creates a lock depositing some amount\n    await sdlToken\n      .connect(signers[1])\n      .transferAndCall(\n        s

Vulnerable code:
```\n  it('PoC user will lose extra deposited tokens', async () => {\n\n    let user = accounts[1]\n    let initialUserSDLBalance = await sdlToken.balanceOf(user);\n\n    // User creates a lock depositing some amount\n    await sdlToken\n      .connect(signers[1])\n      .transferAndCall(\n        sdlPool.address,\n        toEther(100),\n        ethers.utils.defaultAbiCoder.encode(['uint256', 'uint64'], [0, 0])\n      )\n\n    await sdlPool.handleOutgoingUpdate()\n    await sdlPool.handleIncomingUpdate(1)\n    await sdlPool.connect(signers[1]).executeQueuedOperations([])\n\n    assert.equal(await sdlPool.ownerOf(1), user)\n    \n    // User queues a withdraw of all the amount from the lock\n    await sdlPool.connect(signers[1]).withdraw(1, toEther(100))\n\n    // User wants to deposit more tokens to the lock without the withdraw being updated and still being in the queue\n    await sdlToken\n      .connect(signers[1])\n      .transferAndCall(\n        sdlPool.address,\n        toEther(1000),\n        ethers.utils.defaultAbiCoder.encode(['uint256', 'uint64'], [1, 0])\n      )\n\n    await sdlPool.handleOutgoingUpdate()\n    await sdlPool.handleIncomingUpdate(2)\n    // When executing the updates, zero address will be the owner of his lock\n    // and the amount he diposited the last time will be lost\n    await sdlPool.connect(signers[1]).executeQueuedOperations([1])\n\n    let finalUserSDLBalance = await sdlToken.balanceOf(user);\n    let sdlLost = initialUserSDLBalance.sub(finalUserSDLBalance)\n\n    console.log("The user has lost", sdlLost.toString(), "sdl tokens")\n\n    // This staticall should revert because now the lock owner is the zero address\n    await expect(sdlPool.ownerOf(1)).to.be.revertedWith('InvalidLockId()')\n  })\n```\n
MEDIUM severity: Vulnerable function: ```\n    function swap(\n        uint16 _chainId,\n        uint256 _srcPoolId,\n        uint256 _dst. ```\n    function swap(\n        uint16 _chainId,\n        uint256 _srcPoolId,\n        uint256 _dstPoolId,\n        address payable _refundAddress,\n        Pool.CreditObj memory _c,\n        Pool.SwapObj memory _s,\n        IStargateRouter.lzTxObj memory _lzTxParams, \n        bytes calldata _to,\

Vulnerable code:
```\n    function swap(\n        uint16 _chainId,\n        uint256 _srcPoolId,\n        uint256 _dstPoolId,\n        address payable _refundAddress,\n        Pool.CreditObj memory _c,\n        Pool.SwapObj memory _s,\n        IStargateRouter.lzTxObj memory _lzTxParams, \n        bytes calldata _to,\n        bytes calldata _payload\n    ) external payable onlyRouter {\n        bytes memory payload = abi.encode(TYPE_SWAP_REMOTE, _srcPoolId, _dstPoolId, _lzTxParams.dstGasForCall, _c, _s, _to, _payload);\n        _call(_chainId, TYPE_SWAP_REMOTE, _refundAddress, _lzTxParams, payload);\n    }\n\n    function _call(\n        uint16 _chainId,\n        uint8 _type,\n        address payable _refundAddress,\n        IStargateRouter.lzTxObj memory _lzTxParams,\n        bytes memory _payload\n    ) internal {\n        bytes memory lzTxParamBuilt = _txParamBuilder(_chainId, _type, _lzTxParams);\n        uint64 nextNonce = layerZeroEndpoint.getOutboundNonce(_chainId, address(this)) + 1;\n        layerZeroEndpoint.send{value: msg.value}(_chainId, bridgeLookup[_chainId], _payload, _refundAddress, address(this), lzTxParamBuilt);\n        emit SendMsg(_type, nextNonce);\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\n    function _addKeysAndLoansInfo(\n        bool update,\n        bytes32 borrowingKey,\n      . ```\n    function _addKeysAndLoansInfo(\n        bool update,\n        bytes32 borrowingKey,\n        LoanInfo[] memory sourceLoans\n    ) private {\n        // Get the storage reference to the loans array for the borrowing key\n        LoanInfo[] storage loans = loansInfo[borrowingKey];\n        //

Vulnerable code:
```\n    function _addKeysAndLoansInfo(\n        bool update,\n        bytes32 borrowingKey,\n        LoanInfo[] memory sourceLoans\n    ) private {\n        // Get the storage reference to the loans array for the borrowing key\n        LoanInfo[] storage loans = loansInfo[borrowingKey];\n        // Iterate through the sourceLoans array\n        for (uint256 i; i < sourceLoans.length; ) {\n            // Get the current loan from the sourceLoans array\n            LoanInfo memory loan = sourceLoans[i];\n            // Get the storage reference to the tokenIdLoansKeys array for the loan's token ID\n            bytes32[] storage tokenIdLoansKeys = tokenIdToBorrowingKeys[loan.tokenId];\n            // Conditionally add or push the borrowing key to the tokenIdLoansKeys array based on the 'update' flag\n            update\n                ? tokenIdLoansKeys.addKeyIfNotExists(borrowingKey)\n                : tokenIdLoansKeys.push(borrowingKey);\n    // rest of code\n```\n
MEDIUM severity: Vulnerable function: ```\nimport {IRioLRTOperatorRegistry} from 'contracts/interfaces/IRioLRTOperator. ```\nimport {IRioLRTOperatorRegistry} from 'contracts/interfaces/IRioLRTOperatorRegistry.sol';\nimport {RioLRTOperatorDelegator} from 'contracts/restaking/RioLRTOperatorDelegator.sol';\nimport {CredentialsProofs, BeaconWithdrawal} from 'test/utils/beacon-chain/MockBeaconChain.sol';\n```\n

Vulnerable code:
```\nimport {IRioLRTOperatorRegistry} from 'contracts/interfaces/IRioLRTOperatorRegistry.sol';\nimport {RioLRTOperatorDelegator} from 'contracts/restaking/RioLRTOperatorDelegator.sol';\nimport {CredentialsProofs, BeaconWithdrawal} from 'test/utils/beacon-chain/MockBeaconChain.sol';\n```\n
MEDIUM severity: Vulnerable function: ```\nfor (uint i = sequence.firstUnprocessedMonth; i <= month; ++i) {\n    seque. ```\nfor (uint i = sequence.firstUnprocessedMonth; i <= month; ++i) {\n    sequence.value = sequence.value.add(sequence.addDiff[i]).sub(sequence.subtractDiff[i]);\n    delete sequence.addDiff[i];\n    delete sequence.subtractDiff[i];\n}\n```\n

Vulnerable code:
```\nfor (uint i = sequence.firstUnprocessedMonth; i <= month; ++i) {\n    sequence.value = sequence.value.add(sequence.addDiff[i]).sub(sequence.subtractDiff[i]);\n    delete sequence.addDiff[i];\n    delete sequence.subtractDiff[i];\n}\n```\n
HIGH severity: Access Control vulnerability in FibonacciBalance. /*
 * @source: https://github.com/sigp/solidity-security-blog
 * @author: Suhabe Bugrara
 * @vulnerable_at_lines: 31,38
 */

//added pragma version
pragma solidity ^0.4.22;

contract FibonacciBalance {

    address public fibonacciLibrary;
    // the current fibonacci number to withdraw
    uint pub

Vulnerable code:
/*
 * @source: https://github.com/sigp/solidity-security-blog
 * @author: Suhabe Bugrara
 * @vulnerable_at_lines: 31,38
 */

//added pragma version
pragma solidity ^0.4.22;

contract FibonacciBalance {

    address public fibonacciLibrary;
    // the current fibonacci number to withdraw
    uint public calculatedFibNumber;
    // the starting fibonacci sequence number
    uint public start = 3;
    uint public withdrawalCounter;
    // the fibonancci function selector
    bytes4 constant fibSig = bytes4(sha3("setFibonacci(uint256)"));

    // constructor - loads the contract with ether
    constructor(address _fibonacciLibrary) public payable {
        fibonacciLibrary = _fibonacciLibrary;
    }

    function withdraw() {
        withdrawalCounter += 1;
        // calculate the fibonacci number for the current withdrawal user
        // this sets calculatedFibNumber
        // <yes> <report> ACCESS_CONTROL
        require(fibonacciLibrary.delegatecall(fibSig, withdrawalCounter));
        msg.sender.transfer(calculatedFibNumber * 1 ether);
    }

    // allow users to call fibonacci library functions
    function() public {
        // <yes> <report> ACCESS_CONTROL
        require(fibonacciLibrary.delegatecall(msg.data));
    }
}

// library contract - calculates fibonacci-like numbers;
contract FibonacciLib {
    // initializing the standard fibonacci sequence;
    uint public start;
    uint public calculatedFibNumber;

    // modify the zeroth number in the sequence
    function setStart(uint _start) public {
        start = _start;
    }

    function setFibonacci(uint n) public {
        calculatedFibNumber = fibonacci(n);
    }

    function fibonacci(uint n) internal returns (uint) {
        if (n == 0) return start;
        else if (n == 1) return start + 1;
        else return fibonacci(n - 1) + fibonacci(n - 2);
    }
}


Vulnerability type: access_control
HIGH severity: Access Control vulnerability in arbitrary_location_write_simple. /*
 * @source: https://smartcontractsecurity.github.io/SWC-registry/docs/SWC-124#arbitrary-location-write-simplesol
 * @author: Suhabe Bugrara
 * @vulnerable_at_lines: 27
 */

 pragma solidity ^0.4.25;

 contract Wallet {
     uint[] private bonusCodes;
     address private owner;

     constructor(

Vulnerable code:
/*
 * @source: https://smartcontractsecurity.github.io/SWC-registry/docs/SWC-124#arbitrary-location-write-simplesol
 * @author: Suhabe Bugrara
 * @vulnerable_at_lines: 27
 */

 pragma solidity ^0.4.25;

 contract Wallet {
     uint[] private bonusCodes;
     address private owner;

     constructor() public {
         bonusCodes = new uint[](0);
         owner = msg.sender;
     }

     function () public payable {
     }

     function PushBonusCode(uint c) public {
         bonusCodes.push(c);
     }

     function PopBonusCode() public {
         // <yes> <report> ACCESS_CONTROL
         require(0 <= bonusCodes.length); // this condition is always true since array lengths are unsigned
         bonusCodes.length--; // an underflow can be caused here
     }

     function UpdateBonusCodeAt(uint idx, uint c) public {
         require(idx < bonusCodes.length);
         bonusCodes[idx] = c; // write to any index less than bonusCodes.length
     }

     function Destroy() public {
         require(msg.sender == owner);
         selfdestruct(msg.sender);
     }
 }


Vulnerability type: access_control
HIGH severity: Access Control vulnerability in incorrect_constructor_name1. /*
 * @source: https://github.com/trailofbits/not-so-smart-contracts/blob/master/wrong_constructor_name/incorrect_constructor.sol
 * @author: Ben Perez
 * @vulnerable_at_lines: 20
 */

pragma solidity ^0.4.24;

contract Missing{
    address private owner;

    modifier onlyowner {
        require(ms

Vulnerable code:
/*
 * @source: https://github.com/trailofbits/not-so-smart-contracts/blob/master/wrong_constructor_name/incorrect_constructor.sol
 * @author: Ben Perez
 * @vulnerable_at_lines: 20
 */

pragma solidity ^0.4.24;

contract Missing{
    address private owner;

    modifier onlyowner {
        require(msg.sender==owner);
        _;
    }

    // The name of the constructor should be Missing
    // Anyone can call the IamMissing once the contract is deployed
    // <yes> <report> ACCESS_CONTROL
    function IamMissing()
        public
    {
        owner = msg.sender;
    }

    function () payable {}

    function withdraw()
        public
        onlyowner
    {
       owner.transfer(this.balance);
    }
}


Vulnerability type: access_control
HIGH severity: Access Control vulnerability in incorrect_constructor_name2. /*
 * @source: https://smartcontractsecurity.github.io/SWC-registry/docs/SWC-118#incorrect-constructor-name1sol
 * @author: Ben Perez
 * @vulnerable_at_lines: 18
 */


pragma solidity ^0.4.24;

contract Missing{
    address private owner;

    modifier onlyowner {
        require(msg.sender==owner);

Vulnerable code:
/*
 * @source: https://smartcontractsecurity.github.io/SWC-registry/docs/SWC-118#incorrect-constructor-name1sol
 * @author: Ben Perez
 * @vulnerable_at_lines: 18
 */


pragma solidity ^0.4.24;

contract Missing{
    address private owner;

    modifier onlyowner {
        require(msg.sender==owner);
        _;
    }
    // <yes> <report> ACCESS_CONTROL
    function missing()
        public
    {
        owner = msg.sender;
    }

    function () payable {}

    function withdraw()
        public
        onlyowner
    {
       owner.transfer(this.balance);
    }
}


Vulnerability type: access_control
HIGH severity: Access Control vulnerability in incorrect_constructor_name3. /*
 * @source: https://smartcontractsecurity.github.io/SWC-registry/docs/SWC-118#incorrect-constructor-name2sol
 * @author: Ben Perez
 * @vulnerable_at_lines: 17
 */

pragma solidity ^0.4.24;

contract Missing{
    address private owner;

    modifier onlyowner {
        require(msg.sender==owner);


Vulnerable code:
/*
 * @source: https://smartcontractsecurity.github.io/SWC-registry/docs/SWC-118#incorrect-constructor-name2sol
 * @author: Ben Perez
 * @vulnerable_at_lines: 17
 */

pragma solidity ^0.4.24;

contract Missing{
    address private owner;

    modifier onlyowner {
        require(msg.sender==owner);
        _;
    }
    // <yes> <report> ACCESS_CONTROL
    function Constructor()
        public
    {
        owner = msg.sender;
    }

    function () payable {}

    function withdraw()
        public
        onlyowner
    {
       owner.transfer(this.balance);
    }

}


Vulnerability type: access_control
HIGH severity: Access Control vulnerability in mapping_write. /*
 * @source: https://smartcontractsecurity.github.io/SWC-registry/docs/SWC-124#mapping-writesol
 * @author: Suhabe Bugrara
 * @vulnerable_at_lines: 20
 */

 pragma solidity ^0.4.24;

 //This code is derived from the Capture the Ether https://capturetheether.com/challenges/math/mapping/

 contract 

Vulnerable code:
/*
 * @source: https://smartcontractsecurity.github.io/SWC-registry/docs/SWC-124#mapping-writesol
 * @author: Suhabe Bugrara
 * @vulnerable_at_lines: 20
 */

 pragma solidity ^0.4.24;

 //This code is derived from the Capture the Ether https://capturetheether.com/challenges/math/mapping/

 contract Map {
     address public owner;
     uint256[] map;

     function set(uint256 key, uint256 value) public {
         if (map.length <= key) {
             map.length = key + 1;
         }
        // <yes> <report> ACCESS_CONTROL
         map[key] = value;
     }

     function get(uint256 key) public view returns (uint256) {
         return map[key];
     }
     function withdraw() public{
       require(msg.sender == owner);
       msg.sender.transfer(address(this).balance);
     }
 }


Vulnerability type: access_control
HIGH severity: Access Control vulnerability in multiowned_vulnerable. /*
 * @source: https://github.com/SmartContractSecurity/SWC-registry/blob/master/test_cases/solidity/unprotected_critical_functions/multiowned_vulnerable/multiowned_vulnerable.sol
 * @author: -
 * @vulnerable_at_lines: 38
 */

pragma solidity ^0.4.23;

/**
 * @title MultiOwnable
 */
contract MultiOw

Vulnerable code:
/*
 * @source: https://github.com/SmartContractSecurity/SWC-registry/blob/master/test_cases/solidity/unprotected_critical_functions/multiowned_vulnerable/multiowned_vulnerable.sol
 * @author: -
 * @vulnerable_at_lines: 38
 */

pragma solidity ^0.4.23;

/**
 * @title MultiOwnable
 */
contract MultiOwnable {
  address public root;
  mapping (address => address) public owners; // owner => parent of owner

  /**
  * @dev The Ownable constructor sets the original `owner` of the contract to the sender
  * account.
  */
  constructor() public {
    root = msg.sender;
    owners[root] = root;
  }

  /**
  * @dev Throws if called by any account other than the owner.
  */
  modifier onlyOwner() {
    require(owners[msg.sender] != 0);
    _;
  }

  /**
  * @dev Adding new owners
  * Note that the "onlyOwner" modifier is missing here.
  */
  // <yes> <report> ACCESS_CONTROL
  function newOwner(address _owner) external returns (bool) {
    require(_owner != 0);
    owners[_owner] = msg.sender;
    return true;
  }

  /**
    * @dev Deleting owners
    */
  function deleteOwner(address _owner) onlyOwner external returns (bool) {
    require(owners[_owner] == msg.sender || (owners[_owner] != 0 && msg.sender == root));
    owners[_owner] = 0;
    return true;
  }
}

contract TestContract is MultiOwnable {

  function withdrawAll() onlyOwner {
    msg.sender.transfer(this.balance);
  }

  function() payable {
  }

}


Vulnerability type: access_control