Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: The "votes" balance in the `AdvancedDistributor` contract can be manipulated indefinitely by exploit. The "votes" balance in the `AdvancedDistributor` contract can be manipulated indefinitely by exploiting the `initializeDistributionRecord()` function's lack of access control. This function, which is publicly accessible, allows an attacker to mint an unlimited amount of tokens and delegate them to t...

Vulnerable code:
```\nfunction initializeDistributionRecord(\n    uint32 _domain, \n    address _beneficiary, \n    uint256 _amount, \n    bytes32[] calldata merkleProof\n) external validMerkleProof(_getLeaf(_beneficiary, _amount, _domain), merkleProof) {\n    _initializeDistributionRecord(_beneficiary, _amount);\n}\n```\n```\nfunction _initializeDistributionRecord(\n    address beneficiary,\n    uint256 totalAmount\n) internal virtual override {\n    super._initializeDistributionRecord(beneficiary, totalAmount);\n\n    // add voting power through ERC20Votes extension\n    _mint(beneficiary, tokensToVotes(totalAmount));\n}\n```
MEDIUM severity: The `baseOracleCircuitBreaker` function in LibOracle is responsible for handling the retrieval of pr. The `baseOracleCircuitBreaker` function in LibOracle is responsible for handling the retrieval of prices from the WETH/USDC pool. When an invalid fetch of chainlink data occurs, the function is supposed to revert instead of returning the TWAP price without verifying the liquidity in the pool. Howeve...

Vulnerable code:
```\nfunction baseOracleCircuitBreaker(\n    uint256 protocolPrice,\n    uint80 roundId,\n    int256 chainlinkPrice,\n    uint256 timeStamp,\n    uint256 chainlinkPriceInEth\n) private view returns (uint256 _protocolPrice) {\n    bool invalidFetchData = roundId == 0 || timeStamp == 0\n        || timeStamp > block.timestamp\n        || chainlinkPrice <= 0\n        || block.timestamp > 2 hours + timeStamp;\n\n    if (invalidFetchData || priceDeviation) {\n        uint256 twapPrice = IDiamond(payable(address(this))).estimateWETHInUSDC(\n            Constants.UNISWAP_WETH_BASE_AMT, 30 minutes\n        );\n        uint256 twapPriceInEther = (twapPrice / Constants.DECIMAL_USDC) * 1 ether;\n        uint256 twapPriceInv = twapPriceInEther;\n\n        if (twapPriceInEther == 0) {\n            revert Errors.InvalidTwapPrice();\n        }\n\n        if (invalidFetchData) {\n            return twapPriceInv;\n        }\n    } else {\n        return chainlinkPriceInEth;\n    }\n}\n```
MEDIUM severity: The `TokenFaucet` contract's refill mechanism can lead to an unexpected outcome when the contract's . The `TokenFaucet` contract's refill mechanism can lead to an unexpected outcome when the contract's token balance is replenished after a prolonged period of inactivity. This occurs when the `lastDripTimestamp` value, which tracks the timestamp of the last token distribution, is significantly behind...

Vulnerable code:
```\nuint256 assetTotalSupply = asset.balanceOf(address(this));\nuint256 availableTotalSupply = assetTotalSupply.sub(totalUnclaimed);\nuint256 newSeconds = currentTimestamp.sub(lastDripTimestamp);\nuint256 nextExchangeRateMantissa = exchangeRateMantissa;\nuint256 newTokens;\nuint256 measureTotalSupply = measure.totalSupply();\n\nif (measureTotalSupply > 0 && availableTotalSupply > 0 && newSeconds > 0) {\n    newTokens = newSeconds.mul(dripRatePerSecond);\n    if (newTokens > availableTotalSupply) {\n        newTokens = availableTotalSupply;\n    }\n    uint256 indexDeltaMantissa = measureTotalSupply > 0\n       ? FixedPoint.calculateMantissa(newTokens, measureTotalSupply)\n        : 0;\n    nextExchangeRateMantissa = nextExchangeRateMantissa.add(indexDeltaMantissa);\n\n    emit Dripped(newTokens);\n}\n```
MEDIUM severity: The `gas limit DoS via unbounded operations` vulnerability in the `UserManager.sol` and `UToken.sol`. The `gas limit DoS via unbounded operations` vulnerability in the `UserManager.sol` and `UToken.sol` contracts allows malicious users to exploit the `updateTrust()` and `registerMember()` functions, leading to a denial-of-service (DoS) attack. \n\nIn the `updateTrust()` function, an attacker can rep...

Vulnerable code:
```\nIUserManager(userManager).updateLocked(msg.sender, uint96(amount + fee), true);\n...\nIUserManager(userManager).updateLocked(borrower, uint96(repayAmount - interest), false);\n```\n```\nfunction updateLocked(\n    address borrower,\n    uint96 amount,\n    bool lock\n) external onlyMarket {\n    uint96 remaining = amount;\n\n    for (uint256 i = 0; i < vouchers[borrower].length; i++) {\n        // Code block continues here\n```\n```\nfunction registerMember(address newMember) public virtual whenNotPaused {\n    if (stakers[newMember].isMember) revert NoExistingMember();\n\n    uint256 count = 0;\n    uint256 vouchersLength = vouchers[newMember].length;\n\n    for (uint256 i = 0; i < vouchersLength; i++) {\n        if (vouchers[newMember][i] > 0) {\n            count++;\n        }\n    }\n```
MEDIUM severity: The `_indexOf` function in the `_settleAuction` function is responsible for determining the index of. The `_indexOf` function in the `_settleAuction` function is responsible for determining the index of the bucket with a price closest to the `auctionPrice`. However, if the `auctionPrice` exceeds the `MAX_PRICE` threshold, the `_indexOf` function will revert, causing the entire settlement process to...

Vulnerable code:
```\nif (price_ < MIN_PRICE || price_ > MAX_PRICE):\n    revert BucketPriceOutOfBounds()\n```\n```\nfunction _settleAuction(\n    AuctionsState storage auctions_,\n    mapping(uint256 => Bucket) storage buckets_,\n    DepositsState storage deposits_,\n    address borrowerAddress_,\n    uint256 borrowerCollateral_,\n    uint256 poolType_\n) internal returns (uint256 remainingCollateral_, uint256 compensatedCollateral_) {\n    uint256 auctionPrice = _auctionPrice(\n        auctions_.liquidations[borrowerAddress_].referencePrice,\n        auctions_.liquidations[borrowerAddress_].kickTime\n    );\n\n    uint256 bucketIndex = auctionPrice > MIN_PRICE? _indexOf(auctionPrice) : MAX_FENWICK_INDEX;\n}\n```\n```\nvars.referencePrice = Maths.min(Maths.max(vars.htp, vars.neutralPrice), MAX_INFLATED_PRICE);\n```
MEDIUM severity: The AuraSpell contract's `closePositionFarm` function is vulnerable to a potential sandwich attack d. The AuraSpell contract's `closePositionFarm` function is vulnerable to a potential sandwich attack due to the lack of slippage protection during the exit process. Specifically, the `minAmountsOut` array is not properly initialized, allowing an attacker to manipulate the exit process and potentially...

Vulnerable code:
```\n(\n    uint256[] memory minAmountsOut,\n    address[] memory tokens,\n    uint256 borrowTokenIndex\n) = _getExitPoolParams(param.borrowToken, lpToken);\n\nwAuraPools.getVault(lpToken).exitPool(\n    IBalancerPool(lpToken).getPoolId(),\n    address(this),\n    address(this),\n    IBalancerVault.ExitPoolRequest(\n        tokens,\n        minAmountsOut,\n        abi.encode(0, amountPosRemove, borrowTokenIndex),\n        false\n    )\n)\n```\n```\naddress[] memory tokens, uint256[] memory minAmountsOut, uint256[] memory amountsOut = wAuraPools.getPoolTokens(lpToken);\n\nuint256 length = tokens.length;\nminAmountsOut = new uint256[](length);\n```
MEDIUM severity: The `_payOutFirstInQueue` function in the code is vulnerable to a potential overflow issue during th. The `_payOutFirstInQueue` function in the code is vulnerable to a potential overflow issue during the execution of the `operatorTokenToDataInverse` function. This function is responsible for converting data in Wei to operator tokens, and it does so by multiplying the input data in Wei by the total s...

Vulnerable code:
```\nuint amountOperatorTokens = \n    moduleCall(\n        address(exchangeRatePolicy), \n        abi.encodeWithSelector(\n            exchangeRatePolicy.operatorTokenToDataInverse.selector, \n            amountDataWei\n        )\n    );\n```\n```\nfunction operatorTokenToDataInverse(uint dataWei) external view returns (uint operatorTokenWei) {\n    return dataWei * this.totalSupply() / valueWithoutEarnings();\n}\n```
MEDIUM severity: The decentralized sequencer architecture is vulnerable to a front-running attack when the `finalizeB. The decentralized sequencer architecture is vulnerable to a front-running attack when the `finalizeBlocks` function is executed. In this scenario, a malicious sequencer can exploit the decentralized nature of the system by submitting a `finalizeBlocks` transaction before the original sequencer has c...

Vulnerable code:
```\nfunction finalizeBlocks(\n    BlockData[] calldata _blocksData,\n    bytes calldata _proof,\n    uint256 _proofType,\n    bytes32 _parentStateRootHash\n)\nexternal\nwhenTypeNotPaused(PROVING_SYSTEM_PAUSE_TYPE)\nwhenTypeNotPaused(GENERAL_PAUSE_TYPE)\nonlyRole(OPERATOR_ROLE)\n{\n    if (stateRootHashes[currentL2BlockNumber]!= _parentStateRootHash) {\n        revert StartingRootHashDoesNotMatch();\n    }\n    _finalizeBlocks(_blocksData, _proof, _proofType, _parentStateRootHash, true);\n}\n```
MEDIUM severity: The `_redeemTo` function in the Masset contract fails to consider the collateralization ratio, which. The `_redeemTo` function in the Masset contract fails to consider the collateralization ratio, which is a critical aspect of the collateralized asset redemption process. Unlike the `_redeemMasset` function, which incorporates the collateralization ratio in its calculations, `_redeemTo` neglects to d...

Vulnerable code:
```\nuint256 colRatio = StableMath.min(props.colRatio, StableMath.getFullScale());\n\nuint256 collateralisedMassetQuantity = _mAssetQuantity.mulTruncate(colRatio);\n```
MEDIUM severity: The vulnerability allows an attacker to manipulate the deposit process by exploiting the lack of a s. The vulnerability allows an attacker to manipulate the deposit process by exploiting the lack of a signing group establishment within a specific timeframe. When a funder initiates a new deposit, they must pay for the creation of a keep. However, if the signing group fails to establish the keep withi...

Vulnerable code:
```\nfunction retrieveSignerPubkey(DepositUtils.Deposit storage _d) public {\n    require(_d.inAwaitingSignerSetup(), "Not currently awaiting signer setup");\n\n    bytes memory publicKey = IBondedECDSAKeep(_d.keepAddress).getPublicKey();\n    require(publicKey.length == 64, "public key not set or not 64-bytes long");\n\n    _d.signingGroupPubkeyX = publicKey.slice(0, 32).toBytes32();\n    _d.signingGroupPubkeyY = publicKey.slice(32, 32).toBytes32();\n    require(_d.signingGroupPubkeyY!= bytes32(0) && _d.signingGroupPubkeyX!= bytes32(0), "Keep returned bad pubkey");\n    _d.fundingProofTimerStart = block.timestamp;\n\n    _d.setAwaitingBTCFundingProof();\n    _d.logRegisteredPubkey(\n        _d.signingGroupPubkeyX,\n        _d.signingGroupPubkeyY);\n}\n```\n```\nfunction notifySignerSetupFailure(DepositUtils.Deposit storage _d) public {\n    require(_d.inAwaitingSignerSetup(), "Not awaiting setup");\n    require(\n        block.timestamp > _d.signingGroupRequestedAt + \n        TBTCConstants.getSigningGroupFormationTimeout(),\n        "Signing group formation timeout not yet elapsed"\n    );\n    _d.setFailedSetup();\n    _d.logSetupFailed();\n\n    fundingTeardown(_d);\n}\n```
MEDIUM severity: The `priceLiquidity()` function in the `DepositReceipt_*` contract relies on the `minAnswer` and `ma. The `priceLiquidity()` function in the `DepositReceipt_*` contract relies on the `minAnswer` and `maxAnswer` values obtained from the `PriceFeed.aggregator()` in its constructor. These values are used to set the maximum and minimum price limits when calling the `getOraclePrice` function. However, th...

Vulnerable code:
```\nIAccessControlledOffchainAggregator aggregator = IAccessControlledOffchainAggregator(priceFeed.aggregator());\n\nIAccessControlledOffchainAggregator aggregator = IAccessControlledOffchainAggregator(priceFeed.aggregator());\n\ntokenMinPrice = aggregator.minAnswer();\ntokenMaxPrice = aggregator.maxAnswer();\n\nuint256 oraclePrice = getOraclePrice(priceFeed, tokenMaxPrice, tokenMinPrice);\n\nfunction getOraclePrice(IAggregatorV3 _priceFeed, int192 _maxPrice, int192 _minPrice) public view returns (uint256) {\n    (\n        /*uint80 roundID*/,\n        int signedPrice,\n        /*uint startedAt*/,\n        uint timeStamp,\n        /*uint80 answeredInRound*/\n    ) = _priceFeed.latestRoundData();\n\n    require(signedPrice > 0, "Negative Oracle Price");\n    require(timeStamp >= block.timestamp - HEARTBEAT_TIME, "Stale pricefeed");\n    require(signedPrice < _maxPrice, "Upper price bound breached");\n    require(signedPrice > _minPrice, "Lower price bound breached");\n}\n```\n```\nfunction confirmAggregator(address _aggregator)\n    external\n    onlyOwner()\n{\n    require(_aggregator == address(proposedAggregator), "Invalid proposed aggregator");\n    delete proposedAggregator;\n    setAggregator(_aggregator);\n}\n\n/*\nInternal\n*/\n\nfunction setAggregator(address _aggregator)\n    internal\n{\n    uint16 id = currentPhase.id + 1;\n    currentPhase = Phase(id, AggregatorV2V3Interface(_aggregator));\n    phaseAggregators[id] = AggregatorV2V3Interface(_aggregator);\n}\n\nfunction aggregator()\n    external\n    view\n    returns (address)\n{\n    return address(currentPhase.aggregator);\n}\n```
MEDIUM severity: The `lock()` function in the provided code is vulnerable to a potential reentrancy attack due to its. The `lock()` function in the provided code is vulnerable to a potential reentrancy attack due to its flawed implementation. Specifically, it calls the `_refreshiBGT()` function before pulling the `iBGT` from the user, which can lead to a reentrancy issue.\n\nThe `_refreshiBGT()` function, in turn, c...

Vulnerable code:
```\nfunction lock(uint256 amount) external {\n    uint256 mintAmount = _GiBGTMintAmount(amount);\n    poolSize += amount;\n    _refreshiBGT(amount);\n    SafeTransferLib.safeTransferFrom(ibgt, msg.sender, address(this), amount);\n    _mint(msg.sender, mintAmount);\n    emit iBGTLock(msg.sender, amount);\n}\n\nfunction _refreshiBGT(uint256 ibgtAmount) internal {\n    ERC20(ibgt).approve(ibgtVault, ibgtAmount);\n    iBGTVault(ibgtVault).stake(ibgtAmount);\n}\n```
MEDIUM severity: The `commitRequested()` method in the smart contract is vulnerable to front-running attacks. Specifi. The `commitRequested()` method in the smart contract is vulnerable to front-running attacks. Specifically, an attacker can manipulate the `lastCommittedPublishTime` variable by executing the `commit()` function with a carefully crafted `updateData` parameter. This allows the attacker to set the `las...

Vulnerable code:
```\nfunction commitRequested(uint256 versionIndex, bytes calldata updateData)\n    public\n    payable\n    keep(KEEPER_REWARD_PREMIUM, KEEPER_BUFFER, updateData, "")\n{\n    if (pythPrice.publishTime <= lastCommittedPublishTime) {\n        revert PythOracleNonIncreasingPublishTimes();\n    }\n    lastCommittedPublishTime = pythPrice.publishTime;\n```\n```\nfunction commit(uint256 versionIndex, uint256 oracleVersion, bytes calldata updateData) external payable {\n    if (\n        versionList.length > versionIndex &&\n        versionIndex >= nextVersionIndexToCommit &&\n        oracleVersion == versionList[versionIndex]\n    ) {\n        commitRequested(versionIndex, updateData);\n        return;\n    }\n\n    if (pythPrice.publishTime <= lastCommittedPublishTime) {\n        revert PythOracleNonIncreasingPublishTimes();\n    }\n    lastCommittedPublishTime = pythPrice.publishTime;\n```
MEDIUM severity: The vulnerability is related to the incorrect accrual of interest in the pool. Specifically, when th. The vulnerability is related to the incorrect accrual of interest in the pool. Specifically, when the `_accruePoolInterest` function is called at the beginning of the `drawDebt` function, it only updates the pool state if `poolState_.t0Debt` is not equal to 0. However, when the debt is initially dra...

Vulnerable code:
```\nfunction drawDebt(\n    address borrowerAddress_,\n    uint256 amountToBorrow_,\n    uint256 limitIndex_,\n    uint256 collateralToPledge_\n) external nonReentrant {\n    PoolState memory poolState = _accruePoolInterest();\n\n    DrawDebtResult memory result = BorrowerActions.drawDebt(\n        auctions,\n        deposits,\n        loans,\n        poolState,\n        _availableQuoteToken(),\n        borrowerAddress_,\n        amountToBorrow_,\n        limitIndex_,\n        collateralToPledge_\n    );\n\n    // update pool interest rate state\n    _updateInterestState(poolState, result.newLup);\n}\n```\n```\nif (poolState_.t0Debt!= 0) {\n    if (poolState_.t0Debt!= 0) {\n        uint256 elapsed = block.timestamp - inflatorState.inflatorUpdate;\n        poolState_.isNewInterestAccrued = elapsed!= 0;\n    }\n}\n```\n```\nif (poolState_.isNewInterestAccrued) {\n    inflatorState.inflator = uint208(poolState_.inflator);\n    inflatorState.inflatorUpdate = uint48(block.timestamp);\n\n} else if (poolState_.debt == 0) {\n    inflatorState.inflator = uint208(Maths.WAD);\n    inflatorState.inflatorUpdate = uint48(block.timestamp);\n}\n```\n```\nfunction testPoolBorrowAndRepay() external tearDown {\n    assertEq(_quote.balanceOf(address(_pool)), 50_000 * 1e18);\n    assertEq(_quote.balanceOf(_lender), 150_000 * 1e18);\n\n    // skip 100 days to break test\n    skip(100 days);\n\n    _drawDebt({\n        from: _borrower,\n        borrower: _borrower,\n        amountToBorrow: 21_000 * 1e18,\n        limitIndex: 3_000,\n        collateralToPledge: 100 * 1e18,\n        newLup: 2_981.007422784467321543 * 1e18\n    });\n}\n```
MEDIUM severity: The `setPriceFeed` function in the FujiOracle contract is responsible for setting the address of the. The `setPriceFeed` function in the FujiOracle contract is responsible for setting the address of the price feed for a specific asset. However, it does not enforce the consistency of the price feed's decimals, which can lead to potential misconfigurations with severe consequences on the system's inte...

Vulnerable code:
```\n/**\n * @dev Sets '_priceFeed' address for a '_asset'.\n * Can only be called by the contract owner.\n * Emits a {AssetPriceFeedChanged} event.\n */\nfunction setPriceFeed(address _asset, address _priceFeed) public onlyOwner {\n    require(_priceFeed!= address(0), Errors.VL_ZERO_ADDR);\n    usdPriceFeeds[_asset] = _priceFeed;\n    emit AssetPriceFeedChanged(_asset, _priceFeed);\n}\n```
MEDIUM severity: The Registry contract, a critical component of the Keep protocol, is vulnerable to a security flaw t. The Registry contract, a critical component of the Keep protocol, is vulnerable to a security flaw that allows the `registryKeeper` account to re-enable an operator contract that has been previously disabled by the `panicButton` account. This vulnerability arises from the fact that the `registryKeep...

Vulnerable code:
```\nfunction approveOperatorContract(address operatorContract) public onlyRegistryKeeper {\n    operatorContracts[operatorContract] = 1;\n}\n\nfunction disableOperatorContract(address operatorContract) public onlyPanicButton {\n    operatorContracts[operatorContract] = 2;\n}\n```
MEDIUM severity: The `_updateL1L2MessageStatusToReceived` and `addL1L2MessageHashes` functions in the smart contract . The `_updateL1L2MessageStatusToReceived` and `addL1L2MessageHashes` functions in the smart contract are responsible for updating the status of L1->L2 messages. The `_updateL1L2MessageStatusToReceived` function checks the status of the messages and updates it to `OUTBOX_STATUS_RECEIVED` if it is not...

Vulnerable code:
```\nfunction _updateL1L2MessageStatusToReceived(bytes32[] memory _messageHashes) internal {\n    uint256 messageHashArrayLength = _messageHashes.length;\n\n    for (uint256 i = 0; i < messageHashArrayLength; ) {\n        bytes32 messageHash = _messageHashes[i];\n        uint256 existingStatus = outboxL1L2MessageStatus[messageHash];\n\n        if (existingStatus == INBOX_STATUS_UNKNOWN) {\n            revert L1L2MessageNotSent(messageHash);\n        }\n\n        if (existingStatus!= OUTBOX_STATUS_RECEIVED) {\n            outboxL1L2MessageStatus[messageHash] = OUTBOX_STATUS_RECEIVED;\n        }\n\n        unchecked {\n            i++;\n        }\n    }\n\n    emit L1L2MessagesReceivedOnL2(_messageHashes);\n}\n```\n```\nfunction addL1L2MessageHashes(bytes32[] calldata _messageHashes) external onlyRole(L1_L2_MESSAGE_SETTER_ROLE) {\n    uint256 messageHashesLength = _messageHashes.length;\n\n    if (messageHashesLength > 100) {\n        revert MessageHashesListLengthHigherThanOneHundred(messageHashesLength);\n    }\n\n    for (uint256 i = 0; i < messageHashesLength; ) {\n        bytes32 messageHash = _messageHashes[i];\n        if (inboxL1L2MessageStatus[messageHash] == INBOX_STATUS_UNKNOWN) {\n            inboxL1L2MessageStatus[messageHash] = INBOX_STATUS_RECEIVED;\n        }\n        unchecked {\n            i++;\n        }\n    }\n\n    emit L1L2MessageHashesAddedToInbox(_messageHashes);\n```\n```\nif (existingStatus == INBOX_STATUS_UNKNOWN) {\n    revert L1L2MessageNotSent(messageHash);\n}\n```\n```\ntimestampHashes[i] = blockInfo.l2BlockTimestamp\n```\n```\nclass error:\n    def __init__(self):\n        raise InvalidAction()\n```
MEDIUM severity: The Balancer/Aura code lacks a crucial control mechanism to prevent the sale of BPT LP Tokens during. The Balancer/Aura code lacks a crucial control mechanism to prevent the sale of BPT LP Tokens during the re-investment process. In the `ConvexStakingMixin` contract, the `_isInvalidRewardToken` function ensures that the LP Token (CURVE_POOL_TOKEN) is not sold to external DEXs, as it represents the t...

Vulnerable code:
```\nFile: ConvexStakingMixin.sol\n\nfunction _isInvalidRewardToken(address token) internal override view returns (bool) {\n    return (\n        token == TOKEN_1 ||\n        token == TOKEN_2 ||\n        token == address(CURVE_POOL_TOKEN) ||\n        token == address(CONVEX_REWARD_POOL) ||\n        token == address(CONVEX_BOOSTER) ||\n        token == Deployments.ALT_ETH_ADDRESS\n    );\n}\n```\n```\nFile: AuraStakingMixin.sol\n\nfunction _isInvalidRewardToken(address token) internal override view returns (bool) {\n    return (\n        token == TOKEN_1 ||\n        token == TOKEN_2 ||\n        token == TOKEN_3 ||\n        token == TOKEN_4 ||\n        token == TOKEN_5 ||\n        token == address(AURA_BOOSTER) ||\n        token == address(AURA_REWARD_POOL) ||\n        token == address(Deployments.WETH)\n    );\n}\n```
MEDIUM severity: The `_buildInitiateSwapExecutable()` function in DCA strategies is responsible for determining the s. The `_buildInitiateSwapExecutable()` function in DCA strategies is responsible for determining the swap parameters for the CoW Swap. In its current implementation, the function assumes that the user's entire ERC20 balance is available for the order being built. However, this assumption may not alway...

Vulnerable code:
```\nuint256 amountIn = (inputTokenBalance < params.amountToSwap)? \n    inputTokenBalance : params.amountToSwap;\n```
MEDIUM severity: The `PositionManager` contract's `mint()` function is vulnerable to a denial-of-service (DoS) attack. The `PositionManager` contract's `mint()` function is vulnerable to a denial-of-service (DoS) attack due to an incorrect calculation of the `obtainedPremium` variable. This issue arises from the fact that `obtainedPremium` is calculated using the `DVP::premium()` function, which only considers the o...

Vulnerable code:
```\n(obtainedPremium, ) = dvp.premium(params.strike, params.notionalUp, params.notionalDown)\n```\n```\nIERC20Metadata(baseToken).safeTransferFrom(\n    msg.sender,\n    vault,\n    premium_ + vaultFee\n)\n```