Farseen0/scar-pairs huggingface dataset:
HIGH severity: Violation of Storage Access Rule in ECDSAKernelFactory. Not staking a certain amount in the EntryPoint due to Storage Access rules, causing Bundler error.

Vulnerable code:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.18;

import "./KernelFactory.sol";
import "src/validator/ECDSAValidator.sol";

contract ECDSAKernelFactory {
    KernelFactory public immutable singletonFactory;
    ECDSAValidator public immutable validator;
    IEntryPoint public immutable entryPoint;

    constructor(KernelFactory _singletonFactory, ECDSAValidator _validator, IEntryPoint _entryPoint) {
        singletonFactory = _singletonFactory;
        validator = _validator;
        entryPoint = _entryPoint;
    }

    function createAccount(address _owner, uint256 _index) external returns (EIP1967Proxy proxy) {
        bytes memory data = abi.encodePacked(_owner);
        proxy = singletonFactory.createAccount(validator, data, _index);
    }

    function getAccountAddress(address _owner, uint256 _index) public view returns (address) {
        bytes memory data = abi.encodePacked(_owner);
        return singletonFactory.getAccountAddress(validator, data, _index);
    }
}


Vulnerability type: CWE-284
MEDIUM severity: Repeatedly Initializable. The contract is repeatedly initializable due to missing initialization check.

Vulnerable code:
pragma solidity 0.5.16;

import "./DGDInterface.sol";

contract Acid {
  
  event Refund(address indexed user, uint256 indexed dgds, uint256 refundAmount);

  // wei refunded per 0.000000001 DGD burned
  uint256 public weiPerNanoDGD;
  bool public isInitialized;
  address public dgdTokenContract;
  address public owner;

  modifier onlyOwner() {
    require(owner == msg.sender);
    _;
  }

  modifier unlessInitialized() {
    require(!isInitialized, "contract is already initialized");
    _;
  }

  modifier requireInitialized() {
    require(isInitialized, "contract is not initialized");
    _;
  }

  constructor() public {
    owner = msg.sender;
    isInitialized = false;
  }

  function () external payable {}  

  function init(uint256 _weiPerNanoDGD, address _dgdTokenContract) public onlyOwner() unlessInitialized() returns (bool _success) {
    require(_weiPerNanoDGD > 0, "rate cannot be zero");
    require(_dgdTokenContract != address(0), "DGD token contract cannot be empty");
    weiPerNanoDGD = _weiPerNanoDGD;
    dgdTokenContract = _dgdTokenContract;
    isInitialized = true;
    _success = true;
  }

  function burn() public requireInitialized() returns (bool _success) {
    // Rate will be calculated based on the nearest decimal
    uint256 _amount = DGDInterface(dgdTokenContract).balanceOf(msg.sender);
    uint256 _wei = mul(_amount, weiPerNanoDGD);
    require(address(this).balance >= _wei, "Contract does not have enough funds");
    require(DGDInterface(dgdTokenContract).transferFrom(msg.sender, 0x0000000000000000000000000000000000000000, _amount), "No DGDs or DGD account not authorized");
    address _user = msg.sender;
    (_success,) = _user.call.value(_wei)('');
    require(_success, "Transfer of Ether failed");
    emit Refund(_user, _amount, _wei);
  }

  function mul(uint256 a, uint256 b) internal pure returns (uint256) {
    // Gas optimization: this is cheaper than requiring 'a' not being zero, but the
    // benefit is lost if 'b' is also tested.
    // See: https://github.com/OpenZeppelin/openzeppelin-contracts/pull/522
    if (a == 0) {
      return 0;
    }
    uint256 c = a * b;
    require(c / a == b, "SafeMath: multiplication overflow");

    return c;
  }
}


Vulnerability type: CWE-703|CWE-754
MEDIUM severity: Non-programmatic approach for setting constants. The library Constants sets some constants manually as literals instead of using a programmatic approach.

Vulnerable code:
// SPDX-License-Identifier: AGPL-3.0-or-later
pragma solidity ^0.8.9;

uint256 constant MAX_UINT128 = type(uint128).max;
uint256 constant MAX_UINT256 = type(uint256).max;


Vulnerability type: CWE-710
HIGH severity: Inability to unstake when the contract runs out of rewards. Users cannot withdraw staked tokens if the contract runs out of rewards.

Vulnerable code:
pragma solidity 0.5.16;

import "../interfaces/IERC20Token.sol";

/**
This is just a mockup for the Liquidity Mining contract in the Sovryn-smart-contracts repository
 */
contract LiquidityMining{
    address rewardToken;
    
    mapping( address => mapping(address => uint)) public userLPBalance;

    constructor(address rewardTokenAddress) public{
        rewardToken = rewardTokenAddress;
    }
    /**
	 * @notice deposits pool tokens
	 * @param _poolToken the address of pool token
	 * @param _amount the amount of pool tokens
	 * @param _user the address of user, tokens will be deposited to it or to msg.sender
	 */
	function deposit(address _poolToken, uint256 _amount, address _user) public {
        IERC20Token(_poolToken).transferFrom(address(msg.sender), address(this), _amount);
        userLPBalance[_user][_poolToken] += _amount;
    }

    /**
	 * @notice withdraws pool tokens and transfers reward tokens
	 * @param _poolToken the address of pool token
	 * @param _amount the amount of pool tokens
	 */
	function withdraw(address _poolToken, uint256 _amount, address _user) public {
        require(userLPBalance[_user][_poolToken] >= _amount, "insufficient LP balance");
        userLPBalance[_user][_poolToken] -= _amount;
        IERC20Token(_poolToken).transfer(address(msg.sender), _amount);
        IERC20Token(rewardToken).transfer(address(_user), _amount);
    }
}

Vulnerability type: CWE-664
MEDIUM severity: M3: Insufficient data validation. The contracts have insufficient data validation for parameters that are passing addresses in their init functions.

Vulnerable code:
// SPDX-License-Identifier: BlueOak-1.0.0
pragma solidity 0.8.9;

import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
import "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
import "@openzeppelin/contracts-upgradeable/security/ReentrancyGuardUpgradeable.sol";
import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import "contracts/interfaces/IMain.sol";
import "contracts/mixins/ComponentRegistry.sol";
import "contracts/mixins/Auth.sol";

/**
 * @title Main
 * @notice The center of the system around which Components orbit.
 */
// solhint-disable max-states-count
contract MainP1 is
    Initializable,
    Auth,
    ComponentRegistry,
    ReentrancyGuardUpgradeable,
    UUPSUpgradeable,
    IMain
{
    IERC20 public rsr;

    /// @custom:oz-upgrades-unsafe-allow constructor
    // solhint-disable-next-line no-empty-blocks
    constructor() initializer {}

    /// Initializer
    function init(
        Components memory components,
        IERC20 rsr_,
        uint32 oneshotFreezeDuration_
    ) public virtual initializer {
        __Auth_init(oneshotFreezeDuration_);
        __ComponentRegistry_init(components);
        __UUPSUpgradeable_init();

        rsr = rsr_;
        emit MainInitialized();
    }

    /// @custom:refresher
    /// @custom:interaction CEI
    function poke() external {
        require(!pausedOrFrozen(), "paused or frozen");
        // == Refresher ==
        assetRegistry.refresh();

        // == CE block ==
        require(!pausedOrFrozen(), "paused or frozen");
        furnace.melt();
        stRSR.payoutRewards();
    }

    function hasRole(bytes32 role, address account)
        public
        view
        override(IAccessControlUpgradeable, AccessControlUpgradeable)
        returns (bool)
    {
        return super.hasRole(role, account);
    }

    // === Upgradeability ===
    // solhint-disable-next-line no-empty-blocks
    function _authorizeUpgrade(address newImplementation) internal override onlyRole(OWNER) {}
}


Vulnerability type: CWE-707|CWE-20
HIGH severity: H4: Renounce ownership. Access control issue due to renounce ownership functionality.

Vulnerable code:
// SPDX-License-Identifier: MIT

pragma solidity 0.7.6;

import "@openzeppelin/contracts/access/Ownable.sol";

import "./VeERC20.sol";

/// @title Vote Escrow Joe Token - veJOE
/// @author Trader Joe
/// @notice Infinite supply, used to receive extra farming yields and voting power
contract VeJoeToken is VeERC20("VeJoeToken", "veJOE"), Ownable {
    /// @dev Creates `_amount` token to `_to`. Must only be called by the owner (VeJoeStaking)
    /// @param _to The address that will receive the mint
    /// @param _amount The amount to be minted
    function mint(address _to, uint256 _amount) external onlyOwner {
        _mint(_to, _amount);
    }

    /// @dev Destroys `_amount` tokens from `_from`. Callable only by the owner (VeJoeStaking)
    /// @param _from The address that will burn tokens
    /// @param _amount The amount to be burned
    function burnFrom(address _from, uint256 _amount) external onlyOwner {
        _burn(_from, _amount);
    }
}


Vulnerability type: CWE-284|CWE-282
MEDIUM severity: Lack of permission checks in withdraw. Not having proper access control for withdraw function can lead to unauthorized withdrawals.

Vulnerable code:
pragma solidity 0.6.12;

interface IStakingRewards {
    // Views
    function lastTimeRewardApplicable() external view returns (uint256);

    function rewardPerToken() external view returns (uint256);

    function earned(address account) external view returns (uint256);

    function getRewardForDuration() external view returns (uint256);

    function totalSupply() external view returns (uint256);

    function balanceOf(address account) external view returns (uint256);

    // Mutative

    function stake(uint256 amount) external;

    function withdraw(uint256 amount) external;

    function getReward() external;

    function exit() external;
}


Vulnerability type: CWE-284
HIGH severity: QSP-1 Implicit unbounded trust in peaks. Unbounded trust in peak contracts may lead to malicious activities.

Vulnerable code:
    /*
    Copyright 2018 Set Labs Inc.

    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
*/

pragma solidity 0.4.25;

import { CoreAccounting } from "./extensions/CoreAccounting.sol";
import { CoreFactory } from "./extensions/CoreFactory.sol";
import { CoreInternal } from "./extensions/CoreInternal.sol";
import { CoreIssuance } from "./extensions/CoreIssuance.sol";
import { CoreModuleInteraction } from "./extensions/CoreModuleInteraction.sol";
import { CoreState } from "./lib/CoreState.sol";
import { ITransferProxy } from "./interfaces/ITransferProxy.sol";
import { IVault } from "./interfaces/IVault.sol";


/**
 * @title Core
 * @author Set Protocol
 *
 * The Core contract acts as a coordinator handling issuing, redeeming, and
 * creating Sets, as well as all collateral flows throughout the system.
 */
 /* solium-disable-next-line no-empty-blocks */
contract Core is
    CoreState,
    CoreModuleInteraction,
    CoreAccounting,
    CoreInternal,
    CoreFactory,
    CoreIssuance
{
    /**
     * Constructor function for Core
     *
     * @param _transferProxy       The address of the transfer proxy
     * @param _vault               The address of the vault
     * @param _signatureValidator  The address of the signature validator
     */
    constructor(
        address _transferProxy,
        address _vault,
        address _signatureValidator
    )
        public
    {
        // Commit passed address to transferProxyAddress state variable
        state.transferProxy = _transferProxy;

        // Instantiate instance of transferProxy
        state.transferProxyInstance = ITransferProxy(_transferProxy);

        // Commit passed address to vault state variable
        state.vault = _vault;

        // Instantiate instance of vault
        state.vaultInstance = IVault(_vault);

        // Commit passed address to signatureValidator state variable
        state.signatureValidator = _signatureValidator;
    }
}


Vulnerability type: CWE-284|CWE-285|CWE-862
HIGH severity: LWM - Lack of Withdrawal Mechanism. No mechanism for the owner to withdraw or manage accumulated tokens and ETH.

Vulnerable code:
/**

-ClickBee ETH Smart Contact

Socials:
Website: https://www.beestoken.com
Twitter: https://twitter.com/ClickBee_
Telegram: t.me/ClickbeeToken

*/

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts v4.4.0 (utils/Context.sol)

pragma solidity ^0.8.0;

import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import "@openzeppelin/contracts/access/Ownable.sol";

contract ClickBeeToken is ERC20, Ownable(msg.sender) {
    // Variables
    uint256 private constant _totalSupply = 100_000_000_000 * 10**18; // 100 billion tokens
    uint256 private _buyFeePercentage = 5;
    uint256 private _sellFeePercentage = 5;
    uint256 private constant _maxFeePercentage = 25;

    constructor() ERC20("ClickBee Token", "BEES") {
        _mint(msg.sender, _totalSupply);
    }

    // Buy and Sell functions with fees
    function _calculateFee(uint256 amount, uint256 feePercentage) internal pure returns (uint256) {
        return (amount * feePercentage) / 100;
    }

    function _transferWithFees(
        address sender,
        address recipient,
        uint256 amount,
        uint256 feePercentage
    ) internal {
        uint256 fee = _calculateFee(amount, feePercentage);
        super._transfer(sender, recipient, amount - fee);
        super._transfer(sender, address(this), fee); // Transfer fee to contract
    }

    function setBuyFeePercentage(uint256 newBuyFeePercentage) external onlyOwner {
        require(newBuyFeePercentage <= _maxFeePercentage, "Buy fee exceeds the maximum allowed percentage");
        _buyFeePercentage = newBuyFeePercentage;
    }

    function setSellFeePercentage(uint256 newSellFeePercentage) external onlyOwner {
        require(newSellFeePercentage <= _maxFeePercentage, "Sell fee exceeds the maximum allowed percentage");
        _sellFeePercentage = newSellFeePercentage;
    }

    function buy() external payable {
        _transferWithFees(owner(), msg.sender, msg.value, _buyFeePercentage);
    }

    function sell(uint256 amount) external {
        _transferWithFees(msg.sender, address(this), amount, _sellFeePercentage);
        payable(msg.sender).transfer(amount);
    }

    // Ownership transfer
    function transferOwnership(address newOwner) public override onlyOwner {
        emit OwnershipTransferred(owner(), newOwner);
        super.transferOwnership(newOwner);
    }

    // No need to remove Blacklist functions if not used

    // No need to override transfer function for blacklist check

    // Fallback function to receive Ether
    receive() external payable {}
}

Vulnerability type: CWE-664|CWE-221|CWE-451
MEDIUM severity: Owner of L1MessageRelayer Is Single Point of Failure. Centralized access control to change L2MessageExecutor without checks or safeguards.

Vulnerable code:
// SPDX-License-Identifier: MIT
pragma solidity 0.7.5;

import "@arbitrum/nitro-contracts/src/bridge/IInbox.sol";
import "@openzeppelin/contracts/access/Ownable.sol";

import "./L2MessageExecutor.sol";

contract L1MessageRelayer is Ownable {
  /// @notice Address of the governance TimeLock contract.
  address public timeLock;

  /// @notice Address of arbitrum's L1 inbox contract.
  IInbox public inbox;

  /// @notice Emitted when a retryable ticket is created for relaying L1 message to L2.
  event RetryableTicketCreated(uint256 indexed ticketId);

  /// @notice Throws if called by any account other than the timeLock contract.
  modifier onlyTimeLock() {
    require(
      msg.sender == timeLock,
      "L1MessageRelayer::onlyTimeLock: Unauthorized message sender"
    );
    _;
  }

  constructor(address _timeLock, address _inbox) {
    require(_timeLock != address(0), "_timeLock can't the zero address");
    require(_inbox != address(0), "_inbox can't the zero address");
    timeLock = _timeLock;
    inbox = IInbox(_inbox);
  }

  /// @notice renounceOwnership has been disabled so that the contract is never left without a onwer
  /// @inheritdoc Ownable
  function renounceOwnership() public override onlyOwner {
    revert("function disabled");
  }

  /**
   * @notice sends message received from timeLock to L2MessageExecutorProxy.
   * @param target address of the target contract on arbitrum.
   * @param payLoad message calldata that will be executed by l2MessageExecutorProxy.
   * @param maxSubmissionCost same as maxSubmissionCost parameter of inbox.createRetryableTicket
   * @param maxGas same as maxGas parameter of inbox.createRetryableTicket
   * @param gasPriceBid same as gasPriceBid parameter of inbox.createRetryableTicket
   **/
  function relayMessage(
    address target,
    bytes memory payLoad,
    uint256 maxSubmissionCost,
    uint256 maxGas,
    uint256 gasPriceBid
  ) external payable onlyTimeLock returns (uint256) {
    require(maxGas != 1, "maxGas can't be 1");
    require(gasPriceBid != 1, "gasPriceBid can't be 1");
    uint256 ticketID = inbox.createRetryableTicket{value: msg.value}(
      target,
      0,
      maxSubmissionCost,
      msg.sender,
      msg.sender,
      maxGas,
      gasPriceBid,
      payLoad
    );
    emit RetryableTicketCreated(ticketID);
    return ticketID;
  }
}


Vulnerability type: CWE-284|CWE-282
MEDIUM severity: Changes to L2MessageExecutor Are Error-Prone. Cumbersome and error-prone update process for L2MessageExecutor contract.

Vulnerable code:
// SPDX-License-Identifier: MIT
pragma solidity 0.7.5;

import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";

import {AddressAliasHelper} from "./AddressAliasHelper.sol";

/**
 * @dev This contract executes messages received from layer1 governance on arbitrum.
 * This meant to be an upgradeable contract and it should only be used with TransparentUpgradeableProxy.
 */
contract L2MessageExecutor is ReentrancyGuard {
  /// @notice Address of the L1MessageRelayer contract on mainnet.
  address public l1MessageRelayer;

  /// @dev flag to make sure that the initialize function is only called once
  bool private isInitialized = false;

  constructor() {
		// Disable initialization for external users.
		// Only proxies should be able to initialize this contract.
    isInitialized = true;
  }

  function initialize(address _l1MessageRelayer) external {
    require(!isInitialized, "Contract is already initialized!");
    isInitialized = true;
    require(
      _l1MessageRelayer != address(0),
      "_l1MessageRelayer can't be the zero address"
    );
    l1MessageRelayer = _l1MessageRelayer;
  }

  /**
   * @notice executes message received from L1.
   * @param payLoad message received from L1 that needs to be executed.
   **/
  function executeMessage(bytes calldata payLoad) external nonReentrant {
    // To check that message came from L1, we check that the sender is the L1 contract's L2 alias.
    require(
      msg.sender == AddressAliasHelper.applyL1ToL2Alias(l1MessageRelayer),
      "L2MessageExecutor::executeMessage: Unauthorized message sender"
    );

    (address target, bytes memory callData) = abi.decode(
      payLoad,
      (address, bytes)
    );
    require(target != address(0), "target can't be the zero address");
    (bool success, ) = target.call(callData);
    require(
      success,
      "L2MessageExecutor::executeMessage: Message execution reverted."
    );
  }
}


Vulnerability type: CWE-710
MEDIUM severity: Oracle manipulation. Malicious actors can manipulate Uniswap Oracle by trading X amount back and forth.

Vulnerable code:
pragma solidity ^0.5.2;

interface UniswapV2Library {
    function getAmountsOut(uint amountIn, address[] calldata path) external view returns (uint[] memory amounts);
}

contract Oracle {
    function read() external view returns (bytes32) {
        address _router = 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D;

        uint256 _amountIn = 1e18;

        address[] memory _path = new address[](2);
        _path[0] = 0x431ad2ff6a9C365805eBaD47Ee021148d6f7DBe0; // DF
        _path[1] = 0xeb269732ab75A6fD61Ea60b06fE994cD32a83549; // USDx
        // Rinkeby:
        // _path[0] = 0x5d378961e9D31C0ee394d34741fa1A18144f6Fb5; // DF
        // _path[1] = 0xdBCFff49D5F48DDf6e6df1f2C9B96E1FC0F31371; // USDx

        uint[] memory amounts = UniswapV2Library(_router).getAmountsOut(_amountIn, _path);
        if (amounts[1] != uint256(0)) {
            return bytes32(amounts[1]);
        }
        return bytes32(uint256(0.1e15));
    }
}


Vulnerability type: CWE-435
HIGH severity: BT - Burns Tokens. The contract owner has the authority to burn tokens from a specific address, potentially leading to token loss for users.

Vulnerable code:
// SPDX-License-Identifier: MIT

pragma solidity ^0.8.0;



import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

import {ERC20Permit} from "@openzeppelin/contracts/token/ERC20/extensions/draft-ERC20Permit.sol";

import {ERC20Votes} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Votes.sol";

import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";



contract FBX is ERC20, ERC20Permit, ERC20Votes, Ownable {



    constructor(string memory _name, string memory _symbol, uint256 _totalSupply) ERC20(_name, _symbol) ERC20Permit(_name) {

        _mint(msg.sender, _totalSupply * 10**decimals());

    }



    function decimals() 

        public 

        pure 

        override(ERC20)

        returns (uint8) 

    {

        return 18;

    }



    function burn(address account, uint256 amount)

        external

        onlyOwner()

    {

        _burn(account, amount);

    }



    function _afterTokenTransfer(

        address from,

        address to,

        uint256 amount

    ) internal override(ERC20, ERC20Votes) {

        super._afterTokenTransfer(from, to, amount);

    }



    function _beforeTokenTransfer(

        address from,

        address to,

        uint256 amount

    ) internal override(ERC20) {

        super._beforeTokenTransfer(from, to, amount);

    }



    function _mint(address to, uint256 amount)

        internal

        override(ERC20, ERC20Votes)

    {

        super._mint(to, amount);

    }



    function _burn(address account, uint256 amount)

        internal

        override(ERC20, ERC20Votes)

    {

        super._burn(account, amount);

    }

}

Vulnerability type: CWE-284|CWE-269|CWE-266
MEDIUM severity: Mints Tokens. The contract admin has the authority to mint tokens, which may lead to token inflation.

Vulnerable code:
// SPDX-License-Identifier: MIT
pragma solidity 0.8.9;

import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import "./access/AccessProtected.sol";

contract Floyx is ERC20, ERC20Burnable, AccessProtected {
    uint256 public constant MAX_SUPPLY = 45000000000 ether;

    constructor() ERC20("Floyx", "FLOYX") {}

    function mint(address to, uint256 amount) external onlyAdmin {
        require(MAX_SUPPLY >= amount+totalSupply(), "Floyx: Can not exceed max supply" );
        _mint(to, amount);
    }
}


Vulnerability type: CWE-284|CWE-269