Farseen0/scar-pairs huggingface dataset:
HIGH severity: Wintermute — contract does not use eip155 to prevent replay attacks. To create a contract address on Optimism that is the same as the one on Ethereum, we just need to make sure that the two parameters, sender’s address and the nonce, are the same as the ones used in generating the valid address on Ethereum.. To create a contract address on Optimism that is the same as the one on Ethereum, we just need to make sure that the two parameters, sender's address and the nonce, are the same as the ones used in generating the valid address on Ethereum.

```solidity
/// @dev Allows to create new proxy contact and

Vulnerable code:
/// @dev Allows to create new proxy contact and execute a message call to the new proxy within one transaction.
    /// @param masterCopy Address of master copy.
    /// @param data Payload for message call sent to new proxy contract.
    function createProxy(address masterCopy, bytes memory data)
        public
        returns (Proxy proxy)
    {
        proxy = new Proxy(masterCopy);
        if (data.length > 0)
            // solium-disable-next-line security/no-inline-assembly
            assembly {
                if eq(call(gas, proxy, 0, add(data, 0x20), mload(data), 0, 0), 0) { revert(0, 0) }
            }
        emit ProxyCreation(proxy);
    }

Vulnerability type: Bridge, Signature
HIGH severity: KyberSwap — In the first swap, when calculating Ticks, there is ***incorrect rounding direction during the reinvestment process***. Thus the tick could be manipulated, and `_updateLiquidityAndCrossTick` 0could be bypassed.In the second swap, the `_updateLiquidityAndCrossTick` is being triggered to increase liquidity. However, since there is precision loss in the first swap, the liquidity is then double counted.. https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1

Vulnerable code:
/// @dev estimates deltaL, the swap fee to be collected based on amount specified
/// for the final swap step to be performed,
/// where the next (temporary) tick will not be crossed

function estimateIncrementalLiquidity(
    uint256 absDelta,
    uint256 liquidity,
    uint160 currentSqrtP,
    uint256 feeInFeeUnits,
    bool isExactInput,
    bool isToken0
) internal pure returns (uint256 deltaL) {
    if (isExactInput) {
        if (isToken0) {
            // deltaL = feeInFeeUnits * absDelta * currentSqrtP / 2
            deltaL = FullMath.mulDivFloor(
                currentSqrtP,
                absDelta * feeInFeeUnits,
                C.TWO_FEE_UNITS << C.RES_96
            );
        } else {
            // deltaL = feeInFeeUnits * absDelta * currentSqrtP * 2
            // Because nextSqrtP = (liquidity + absDelta / currentSqrtP) * currentSqrtP / (liquidity + deltaL)
            // so we round down nextSqrtP
            deltaL = FullMath.mulDivFloor(
                C.TWO_POW_96,
                absDelta * feeInFeeUnits,
                C.TWO_FEE_UNITS * currentSqrtP
            );
        }
    }
}

Vulnerability type: Precision, Price Manipulation
HIGH severity: UniBotRouter — The function `0xb2bd16ab` in the `UniBot` does not properly check input parameters. Thus anyone can use this function to arbitrarily call the external token contract and execute the transferFrom() method. Thus anyone who approves the `UniBot` contract may suffer from the attack.. https://twitter.com/PeckShieldAlert/status/1719251390319796477

Vulnerable code:
require(64 + varg0.data + 32 - (64 + varg0.data) >= 32);
require(varga[2] == address(varg0[2]));
CALLDATACOPY(v39.data, varg4.data, varg0.length);
MEM[varg4.length + v39.data] = 0;
v40, /* uint256 */ v41, /* uint256 */ v42 = address(varg0[2]).call(v39.data).value(msg.value).gas(msg.gas);
if (RETURN_DATA_SIZE() != 0) {
    v43 = new bytes[](RETURN_DATA_SIZE());
    RETURN_DATA_COPY(v43.data, 0, RETURN_DATA_SIZE());
}
require(v40, MEM[64], RETURN_DATA_SIZE());

Vulnerability type: Arbitrary call
HIGH severity: FAPEN — It does not update the timestamp after the registration. In this case, the attacker can invoke the function register for multiple times. The `register()` function rewards the double gems token if you statisfy the `if` condition. The hacker abuse the `register()` function to get extra GEM bonuse.. https://twitter.com/AnciliaInc/status/1592658104394473472 https://twitter.com/BlockSecTeam/status/1592734292727455744

Vulnerable code:
function register(address neighbor) external initialized {
	address user = msg.sender;
    require(villages[user].timestamp == 0, "just new users"); //vulnerable points
    uint256 gems;
    totalVillages++;
    if (villages[neighbor].sheeps[0] > 0 && neighbor != manager) {
        gems += GEM_BONUS * 2;
    } else{
        neighbor = manager;
        gems += GEM_BONUS;
    }
    villages[neighbor].neighbors++;
    villages[user].neighbor = neighbor;
    villages[user].gems += gems;
    emit Newbie(msg.sender, gems);
}

Vulnerability type: Business Logic Flaw
HIGH severity: BBOX — FlashLoan price manipulation - `_transfer()` will burn the BBOX token incorrectly.. https://twitter.com/AnciliaInc/status/1599599614490877952

Vulnerable code:
function _transfer(
        address from,
        address to,
        uint256 amount
    ) private {
        require(from != address(0), "ERC20: transfer from the zero address");
        require(amount > 0, "Transfer amount must be greater than zero");

        if( 
            !_isContract(to) 
            && _recommerMapping[to] == address(0) 
            && amount >= recommeCondition){
            
            if( ammPairs[from]  ){
                addRelationEx(holder,to);
            }else{
                addRelationEx(from,to);
            }
        }

        bool isAddLiquidity;
        bool isDelLiquidity;
        ( isAddLiquidity, isDelLiquidity) = _isLiquidity(from,to);

        if( 
            pairAmountChange 
            && !isAddLiquidity
            && pairAmount > 0 
            && !ammPairs[from] 
            && pairAmount < balanceOf(uniswapV2Pair)){

            uint v = pairAmount;
            pairAmount = 0;
            _tOwned[uniswapV2Pair] =  _tOwned[uniswapV2Pair].sub(v); //vulnerable point
            _tOwned[address(0)] = _tOwned[address(0)].add(v);
            emit Transfer(uniswapV2Pair, address(0), v);

            IUniswapV2Pair(uniswapV2Pair).sync();
        }
    }

Vulnerability type: Flashloans, Price Manipulation
HIGH severity: Platypusdefi — The emergencyWithdraw function incorrectly evaluates the insolvency before the collateral removal, resulting in an insolvent debt position after the emergency withdrawal.. https://twitter.com/spreekaway/status/1626319585040338953 https://twitter.com/peckshield/status/1626367531480125440 https://twitter.com/danielvf/status/1626340324103663617

Vulnerable code:
function emergencyWithdraw(uint256 _pid) public nonReentrant {
        PoolInfo storage pool = poolInfo[_pid];
        UserInfo storage user = userInfo[_pid][msg.sender];

        if (address(platypusTreasure) != address(0x00)) {
            (bool isSolvent, ) = platypusTreasure.isSolvent(msg.sender, address(poolInfo[_pid].lpToken), true); //Vulnerable Point: No Check for Adjustment for borrowed funds
            require(isSolvent, 'remaining amount exceeds collateral factor');
        }

        // reset rewarder before we update lpSupply and sumOfFactors
        IBoostedMultiRewarder rewarder = pool.rewarder;
        if (address(rewarder) != address(0)) {
            rewarder.onPtpReward(msg.sender, user.amount, 0, user.factor, 0);
        }

        // SafeERC20 is not needed as Asset will revert if transfer fails
        pool.lpToken.transfer(address(msg.sender), user.amount);

        // update non-dialuting factor
        pool.sumOfFactors -= user.factor;

        user.amount = 0;
        user.factor = 0;
        user.rewardDebt = 0;

        emit EmergencyWithdraw(msg.sender, _pid, user.amount);
    }

Vulnerability type: Incorrect logic, Miscalculation, lending
HIGH severity: GROKD — There is access control issue in `0xd2beb00a` function that leads to the exploit.. Root cause: Vulnerable code snippet: [ChainDuck on Twitter / X](https://x.com/hipalex921/status/1778482890705416323?t=KvvG83s7SXr9I55aftOc6w&s=05)

Vulnerable code:
function 0xd2beb00a(uint256 varg0, uint256 varg1, uint256 varg2, uint256 varg3) public nonPayable {
    require(msg.data.length - 4 >= 128);
    require(msg.data.length - 4 + ~31 >= 96);
    require(!((MEM[64] + 96 > uint64.max) | (MEM[64] + 96 < MEM[64])), Panic(65)); // failed memory allocation (too much memory)
    MEM[64] = MEM[64] + 96;
    require(varg0 < _poolInfo.length, Panic(50)); // access an out-of-bounds or negative index of bytesN array or slice
    _poolInfo[varg0].field0 = varg1;
    _poolInfo[varg0].field1 = varg2;
    _poolInfo[varg0].field2 = varg3;
}

Vulnerability type: Access Control, Lack of permission control
HIGH severity: LW — KALOS: LW was hacked on May 11, 2023. This vulnerability is under the category of Rugpull cases, which, unlike other instances, were exploited by owners. A total of 6 accounts had funds forcefully drained.. https://twitter.com/PeckShieldAlert/status/1656850634312925184 https://twitter.com/hexagate_/status/1657051084131639296 https://twitter.com/kalos_security/status/1668092799512907777

Vulnerable code:
receive() external payable {
        if(thanPrice==0) return;
        if(IERC20(_token).balanceOf(_marketAddr) >= 3000e18) {
            IERC20(_token).transferFrom(_marketAddr, address(this), 3000e18);
            swapTokensForDead(3000e18); //vulnerable point
            thanPrice -= 1;
        }
    }

Vulnerability type: Sandwich
HIGH severity: Bazaar — The root cause is no permission check in the `exitPool` function, allowing anyone to impersonate liquidity providers and drain the pool. https://x.com/shoucccc/status/1800353122159833195

Vulnerable code:
function exitPool(bytes32 poolId, address sender, address payable recipient, ExitPoolRequest memory request)
        external
        override
        nonReentrant
        registeredPool(poolId)
    {
        (address[] memory tokens, uint256[] memory balances,) = getPoolTokens(poolId);
        require(tokens.length == TOKENS_LENGTH && tokens.length == request.tokens.length, "mismatch tokens length");

        IBazaarLBP lbp = IBazaarLBP(_getPoolAddress(poolId));
        (uint256[] memory amountsOut,) = lbp.onExitPool(poolId, sender, recipient, balances, 0, 0, request.userData); <-- vulnerable point

        for (uint256 i = 0; i < tokens.length; i++) {
            uint256 amountOut = amountsOut[i];
            require(amountOut >= request.minAmountsOut[i], "limit not reached");
            require(tokens[i] == _translateToErc20(request.tokens[i]), "token mismatch");

            address token = tokens[i];
            poolBalances[poolId][token] = poolBalances[poolId][token].sub(amountOut);

            // use original address such that ETH is supported
            _sendFunds(request.tokens[i], recipient, amountOut);
        }
    }

Vulnerability type: Access Control, Lack of permission control
HIGH severity: Spectra finance — The root cause is an arbitrary call in their router contract, which allows the attacker to drain all tokens approved to that contract.. https://x.com/shoucccc/status/1815981585637990899

Vulnerable code:
} else if (command == Commands.KYBER_SWAP) {
    address kyberRouter,
    address tokenIn,
    uint256 amountIn,
    address tokenOut,
    bytes memory targetData = abi.decode(_inputs, (address, address, uint256, address, uint256, bytes));
    
    if (tokenOut == Constants.ETH) {
        revert AddressError();
    }

    if (tokenIn == Constants.ETH) {
        if (msg.value != amountIn) {
            revert AmountError();
        }
    } else {
        amountIn = _resolveTokenValue(tokenIn, amountIn);
        IERC20(tokenIn).forceApprove(kyberRouter, amountIn);
        (bool success,) = kyberRouter.call{value: msg.value}(targetData); // Arbitrary Call to Any Address
        if (!success) {
            revert CallFailed();
        }
    }
}

Vulnerability type: Insufficient validation
HIGH severity: Auctus — Arbitrary call via write(). exchangeData is controllable and without any input validation. Vulnerable code snippet: 
[https://etherscan.io/address/0xE7597F774fD0a15A617894dc39d45A28B97AFa4f#code#F1#L101](https://etherscan.io/address/0xE7597F774fD0a15A617894dc39d45A28B97AFa4f#code#F1#L101)
exchangeData is controllable and without any input validation. 

Vulnerable point: [https://etherscan

Vulnerable code:
function write(
        address acoToken, 
        uint256 collateralAmount, 
        address exchangeAddress, 
        bytes memory exchangeData 
    ) 
        nonReentrant 
        setExchange(exchangeAddress) 
        public 
        payable 
    {
        require(msg.value > 0,  "ACOWriter::write: Invalid msg value");
        require(collateralAmount > 0,  "ACOWriter::write: Invalid collateral amount");
        
        address _collateral = IACOToken(acoToken).collateral();
        if (_isEther(_collateral)) {
            IACOToken(acoToken).mintToPayable{value: collateralAmount}(msg.sender);
        } else {
            _transferFromERC20(_collateral, msg.sender, address(this), collateralAmount);
            _approveERC20(_collateral, acoToken, collateralAmount);
            IACOToken(acoToken).mintTo(msg.sender, collateralAmount);
        }
        
        _sellACOTokens(acoToken, exchangeData);
    }
    /**
     * @dev Internal function to sell the ACO tokens and transfer the premium to the transaction sender.
     * @param acoToken Address of the ACO token.
     * @param exchangeData Data to be sent to the exchange.
     */
    function _sellACOTokens(address acoToken, bytes memory exchangeData) internal {
        uint256 acoBalance = _balanceOfERC20(acoToken, address(this));
        _approveERC20(acoToken, erc20proxy, acoBalance);
        (bool success,) = _exchange.call{value: address(this).balance}(exchangeData); //vulnerable point
        require(success, "ACOWriter::_sellACOTokens: Error on call the exchange");

Vulnerability type: Arbitrary call
HIGH severity: DFS — Price Manipulation. When the receiving address of the dFS token transfer is the pair, a certain percentage of the tokens at this address will be additionally destroyed, and the attacker manipulates the price by invoking the transfer() and skim() function to burn the dfs tokens in the pair.. https://twitter.com/CertiKAlert/status/1608788290785665024

Vulnerable code:
function _transfer(
        address       address to,
        uint256 amount
    ) internal {
        require(from != address(0), "ERC20: transfer from the zero address");
        require(amount > 0, "Transfer amount must be greater than zero");
        if (from == address(this) || to == address(this)) {
            return;
        }
        uint256 rate = 5;
        uint256 fee = 0;
        if (to == address(pair) || from == address(pair)) { 
            if (takeFee && !exclusiveFromFee[from]) {
                fee = amount.mul(rate).div(1000);
                _balance[from] = _balance[from].sub(amount).sub(fee);
                _balance[destroyAddress] = _balance[destroyAddress].add(fee);
                emit Transfer(from, destroyAddress, fee);
            }
        } else {
            _balance[from] = _balance[from].sub(amount);
        }
        if (_balance[from] == 0 && holders.length != 0) {
            holders[holdersIndex[from]] = holders[holders.length-1];
            holdersIndex[holders[holders.length-1]] = holdersIndex[from];
            holders.pop();
            includeHolders[from] = false;
        }
        _balance[to] = _balance[to].add(amount);
        if (!includeHolders[to]) {
            holdersIndex[to] = holders.length;
            holders.push(to);
            includeHolders[to] = true;
        }
        emit Transfer(from, to, amount);
    }

Vulnerability type: Flashloans, Insufficient validation, skim
HIGH severity: APEDAO — $APEDAO contract mistook the attacker's behavior transfer as a sell operation and gradually added up a value called "amountToDead".Then the attacker repeatedly transfer in $APEDAO .Eventually, the attacker calls godead function to burn the $APEDAO held in the pair contract, causing the token price to rise.. https://twitter.com/BeosinAlert/status/1681316257034035201

Vulnerable code:
if (_transferType == 1){ // 1: buy
            if ( openTime < block.timestamp && block.timestamp < limitTime  ){
                require(_balances[_to] <= limitUserHave , "current limit");
            }
        }

        setShareAndProcess(_from,_to,isSwap);

        if (_transferType == 2){ 
            if (isOpenToDead){
                amountToDead += amountx * 20 /100;
            }
            
        }
        
function goDead() public{
        if (amountToDead > 0){
            _rawTransfer(address(pair), address(0xdEaD), amountToDead);
            pair.sync();
            amountToDead = 0;
        }
    }

Vulnerability type: Business Logic Flaw
HIGH severity: Poly Network — Insufficient validation. Brute-force a `_method` field that hashes to a 32-bit value that is exactly the ID for putCurEpochConPubKeyBytes! In other words, the ID of the function called is computed as the 32-bit truncation of a 256-bit Keccak hash of the string _method and a suffix.. brute-force a **_method** field that hashes to a 32-bit value that is exactly the ID for putCurEpochConPubKeyBytes!

Vulnerable code:
bytes4(keccak256(abi. encodePacked (_method, "(bytes, bytes, uint64)") )),

Vulnerability type: Bridge, CrossChain, Insufficient validation
HIGH severity: Uranium — Incorrect calculation. Inconsistent value in the code, 10000 vs 1000. Vulnerable code snippet: same Nimbus's issue
[https://bscscan.com/address/0xA943eA143cd7E79806d670f4a7cf08F8922a454F#code#F3#L180](https://bscscan.com/address/0xA943eA143cd7E79806d670f4a7cf08F8922a454F#code#F3#L180)
inconsistent value in the code, 10000 vs 1000
```solidity
function swap(uint amount0

Vulnerable code:
function swap(uint amount0Out, uint amount1Out, address to, bytes calldata data) external lock {
        require(amount0Out > 0 || amount1Out > 0, 'UraniumSwap: INSUFFICIENT_OUTPUT_AMOUNT');
        (uint112 _reserve0, uint112 _reserve1,) = getReserves(); // gas savings
        require(amount0Out < _reserve0 && amount1Out < _reserve1, 'UraniumSwap: INSUFFICIENT_LIQUIDITY');

        uint balance0;
        uint balance1;
        { // scope for _token{0,1}, avoids stack too deep errors
        address _token0 = token0;
        address _token1 = token1;
        require(to != _token0 && to != _token1, 'UraniumSwap: INVALID_TO');
        if (amount0Out > 0) _safeTransfer(_token0, to, amount0Out); // optimistically transfer tokens
        if (amount1Out > 0) _safeTransfer(_token1, to, amount1Out); // optimistically transfer tokens
        if (data.length > 0) IUraniumCallee(to).pancakeCall(msg.sender, amount0Out, amount1Out, data);
        balance0 = IERC20(_token0).balanceOf(address(this));
        balance1 = IERC20(_token1).balanceOf(address(this));
        }
        uint amount0In = balance0 > _reserve0 - amount0Out ? balance0 - (_reserve0 - amount0Out) : 0;
        uint amount1In = balance1 > _reserve1 - amount1Out ? balance1 - (_reserve1 - amount1Out) : 0;
        require(amount0In > 0 || amount1In > 0, 'UraniumSwap: INSUFFICIENT_INPUT_AMOUNT');
        { // scope for reserve{0,1}Adjusted, avoids stack too deep errors
        uint balance0Adjusted = balance0.mul(10000).sub(amount0In.mul(16)); //vulnerable point
        uint balance1Adjusted = balance1.mul(10000).sub(amount1In.mul(16)); //vulnerable point
        require(balance0Adjusted.mul(balance1Adjusted) >= uint(_reserve0).mul(_reserve1).mul(1000**2), 'UraniumSwap: K'); //vulnerable
        }

Vulnerability type: Dex/AMM, ERC20, Miscalculation
HIGH severity: Game — The exploit stemmed from a logic error in newBidEtherMin(), enabling a single attacker to place bids exceeding 5% of the last bid amount without validation. This flaw resulted in unintended addresses receiving the full last bid amount. Additionally, using "call" in _sendEther facilitated re-entrancy attacks, allowing the attacker to make unauthorized transfers. https://twitter.com/AnciliaInc/status/1757533144033739116

Vulnerable code:
function makeBid() external payable {
        require(msg.value > newBidEtherMin(), "bid is too low");
        if (bidAddress != address(0)) {
            _sendEther(bidAddress, bidEther);
        }
        bidAddress = msg.sender;
        bidEther = msg.value;
        if (auctionEndTime == 0)
            auctionEndTime = block.timestamp + auctionStartTimer;
        else auctionEndTime += auctionBidAddsTimer;
    }
...
function newBidEtherMin() public view returns (uint256) {
        return (bidEther * auctionBidStepShare) / auctionBidStepPrecesion;
    }
...
function _sendEther(address to, uint256 count) internal {
        (bool sentFee, ) = payable(to).call{value: count}("");
        require(sentFee, "sent fee error: ether is not sent");
    }

Vulnerability type: Reentrancy
HIGH severity: TheNFTV2 — The attackers keep approving NFT token ID 1071 to themselves and burn the token. After the burn operation, they can retrieve the token through transferFrom and re-burn it repeatedly. During each operation, the attacker receives some $THEDAO tokens as a reward.. https://x.com/MetaTrustAlert/status/1728616715825848377?s=20

Vulnerable code:
function transferFrom(address _from, address _to, uint256 _tokenId) external regulated(_to) {
    require (_tokenId < max, "index out of range");
    address o = ownership[_tokenId];
    require (o == _from, "_from must be owner");
    address a = approval[_tokenId];
    require (o == msg.sender|| (a == msg.sender) || (approvalAll[o][msg.sender]), "not permitted");
    _transfer(_from, _to, _tokenId);
    if (a != address(0)) {
        approval[_tokenId] = address(0); // clear previous approval
        emit Approval(msg.sender, address(0), _tokenId);
    }
}
...
function burn(uint256 id) external {
    require (msg.sender == ownership[id], "only owner can burn");
    if (theDAO.transfer(msg.sender, oneDao)) {   // send theDAO token back to sender
        _transfer(msg.sender, DEAD_ADDRESS, id); // burn the NFT token
        emit Burn(msg.sender, id);
    }
}

Vulnerability type: Business Logic Flaw, Incorrect logic
HIGH severity: GYMNetwork — Incorrect access control.. Incorrect access control.

Vulnerable code:
/**
     * @notice Deposit in given pool
     * @param _depositAmount: Amount of want token that user wants to deposit
     */
    function depositFromOtherContract(
        uint256 _depositAmount,
        uint8 _periodId,
        bool isUnlocked,
        address _from
    ) external external {  //vulnerable point
        require(isPoolActive,'Contract is not running yet');
        _autoDeposit(_depositAmount,_periodId,isUnlocked,_from);
    }

Vulnerability type: Access Control, ERC20