Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: Vulnerable function: ```\nFile: VaultConfiguration.sol\n            if (vaultAccount.tempCashBalance . ```\nFile: VaultConfiguration.sol\n            if (vaultAccount.tempCashBalance < 0) {\n                int256 x = vaultConfig.primeRate.convertToUnderlying(vaultAccount.tempCashBalance).neg();\n                underlyingExternalToRepay = underlyingToken.convertToUnderlyingExternalWithAdjustment(x).

Vulnerable code:
```\nFile: VaultConfiguration.sol\n            if (vaultAccount.tempCashBalance < 0) {\n                int256 x = vaultConfig.primeRate.convertToUnderlying(vaultAccount.tempCashBalance).neg();\n                underlyingExternalToRepay = underlyingToken.convertToUnderlyingExternalWithAdjustment(x).toUint();\n            } else {\n                // Otherwise require that cash balance is zero. Cannot have a positive cash balance in this method\n                require(vaultAccount.tempCashBalance == 0);\n            }\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction convertToShares(uint256 assets) public view virtual returns (uint256) {\n    uint256 s. ```\nfunction convertToShares(uint256 assets) public view virtual returns (uint256) {\n    uint256 supply = totalSupply(); // Saves an extra SLOAD if totalSupply is non-zero.\n\n    return supply == 0 ? assets : assets.mulDivDown(supply, totalAssets());\n}\n```\n

Vulnerable code:
```\nfunction convertToShares(uint256 assets) public view virtual returns (uint256) {\n    uint256 supply = totalSupply(); // Saves an extra SLOAD if totalSupply is non-zero.\n\n    return supply == 0 ? assets : assets.mulDivDown(supply, totalAssets());\n}\n```\n
HIGH severity: Vulnerable function: ```\n    _exitBalancerPool(lpAmount_, minTokenAmounts_);\n\n    // Calculate OHM. ```\n    _exitBalancerPool(lpAmount_, minTokenAmounts_);\n\n    // Calculate OHM and wstETH amounts received\n    uint256 ohmAmountOut = ohm.balanceOf(address(this)) - ohmBefore;\n    uint256 wstethAmountOut = wsteth.balanceOf(address(this)) - wstethBefore;\n\n    // Calculate oracle expected wstETH

Vulnerable code:
```\n    _exitBalancerPool(lpAmount_, minTokenAmounts_);\n\n    // Calculate OHM and wstETH amounts received\n    uint256 ohmAmountOut = ohm.balanceOf(address(this)) - ohmBefore;\n    uint256 wstethAmountOut = wsteth.balanceOf(address(this)) - wstethBefore;\n\n    // Calculate oracle expected wstETH received amount\n    // getTknOhmPrice returns the amount of wstETH per 1 OHM based on the oracle price\n    uint256 wstethOhmPrice = manager.getTknOhmPrice();\n    uint256 expectedWstethAmountOut = (ohmAmountOut * wstethOhmPrice) / _OHM_DECIMALS;\n\n    // Take any arbs relative to the oracle price for the Treasury and return the rest to the owner\n    uint256 wstethToReturn = wstethAmountOut > expectedWstethAmountOut\n        ? expectedWstethAmountOut\n        : wstethAmountOut;\n    if (wstethAmountOut > wstethToReturn)\n        wsteth.safeTransfer(TRSRY(), wstethAmountOut - wstethToReturn);\n\n    // Burn OHM\n    ohm.increaseAllowance(MINTR(), ohmAmountOut);\n    manager.burnOhmFromVault(ohmAmountOut);\n\n    // Return wstETH to owner\n    wsteth.safeTransfer(msg.sender, wstethToReturn);\n```\n
MEDIUM severity: Vulnerable function: ```\nfile: QVBaseStrategy.sol\n    function reviewRecipients(address[] calldata _recipientIds, Statu. ```\nfile: QVBaseStrategy.sol\n    function reviewRecipients(address[] calldata _recipientIds, Status[] calldata _recipientStatuses)\n        external\n        virtual\n        onlyPoolManager(msg.sender)\n        onlyActiveRegistration\n    {\n        // make sure the arrays are the same length\n  

Vulnerable code:
```\nfile: QVBaseStrategy.sol\n    function reviewRecipients(address[] calldata _recipientIds, Status[] calldata _recipientStatuses)\n        external\n        virtual\n        onlyPoolManager(msg.sender)\n        onlyActiveRegistration\n    {\n        // make sure the arrays are the same length\n        uint256 recipientLength = _recipientIds.length;\n        if (recipientLength != _recipientStatuses.length) revert INVALID();\n\n        for (uint256 i; i < recipientLength;) {\n            Status recipientStatus = _recipientStatuses[i];\n            address recipientId = _recipientIds[i];\n\n            // if the status is none or appealed then revert\n            if (recipientStatus == Status.None || recipientStatus == Status.Appealed) { //@audit these are the input parameter statuse not the recipient's status.\n                revert RECIPIENT_ERROR(recipientId);\n            }\n\n            reviewsByStatus[recipientId][recipientStatus]++;\n\n -->        if (reviewsByStatus[recipientId][recipientStatus] >= reviewThreshold) { //@audit recipientStatus is updated right after the threshold is reached. It can overwrite if the status is already set.\n                Recipient storage recipient = recipients[recipientId];\n                recipient.recipientStatus = recipientStatus;\n\n                emit RecipientStatusUpdated(recipientId, recipientStatus, address(0));\n            }\n\n            emit Reviewed(recipientId, recipientStatus, msg.sender);\n\n            unchecked {\n                ++i;\n            }\n        }\n    }\n```\n
HIGH severity: Vulnerable function: ```\nfunction setNumberOfWinners(uint256 count) external onlyOwner {\n  \_\_numberOfWinners = count;. ```\nfunction setNumberOfWinners(uint256 count) external onlyOwner {\n  \_\_numberOfWinners = count;\n\n  emit NumberOfWinnersSet(count);\n}\n```\n

Vulnerable code:
```\nfunction setNumberOfWinners(uint256 count) external onlyOwner {\n  \_\_numberOfWinners = count;\n\n  emit NumberOfWinnersSet(count);\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nFile: contracts\OperatorTokenomics\Operator.sol\n        // transfer create. ```\nFile: contracts\OperatorTokenomics\Operator.sol\n        // transfer creates a new delegator: check if the delegation policy allows this "delegation"\n        if (balanceOf(to) == 0) {\n            if (address(delegationPolicy) != address(0)) {\n                moduleCall(address(delegationPoli

Vulnerable code:
```\nFile: contracts\OperatorTokenomics\Operator.sol\n        // transfer creates a new delegator: check if the delegation policy allows this "delegation"\n        if (balanceOf(to) == 0) {\n            if (address(delegationPolicy) != address(0)) {\n                moduleCall(address(delegationPolicy), abi.encodeWithSelector(delegationPolicy.onDelegate.selector, to)); //@audit\nshould be called after _transfer()\n            }\n        }\n        super._transfer(from, to, amount);\n```\n
MEDIUM severity: Vulnerable function: ```\n    function _createHat(\n        uint256 _id,\n        string calldata _details,\n        uint. ```\n    function _createHat(\n        uint256 _id,\n        string calldata _details,\n        uint32 _maxSupply,\n        address _eligibility,\n        address _toggle,\n        bool _mutable,\n        string calldata _imageURI\n    ) internal returns (Hat memory hat) {\n        hat.details = _de

Vulnerable code:
```\n    function _createHat(\n        uint256 _id,\n        string calldata _details,\n        uint32 _maxSupply,\n        address _eligibility,\n        address _toggle,\n        bool _mutable,\n        string calldata _imageURI\n    ) internal returns (Hat memory hat) {\n        hat.details = _details;\n        hat.maxSupply = _maxSupply;\n        hat.eligibility = _eligibility;\n        hat.toggle = _toggle;\n        hat.imageURI = _imageURI;\n        hat.config = _mutable ? uint96(3 << 94) : uint96(1 << 95);\n        _hats[_id] = hat;\n\n\n        emit HatCreated(_id, _details, _maxSupply, _eligibility, _toggle, _mutable, _imageURI);\n    }\n```\n
HIGH severity: Vulnerable function: ```\n/\*\*\n \* @dev Function used to inform about the fact the currently ongoing\n \* new relay ent. ```\n/\*\*\n \* @dev Function used to inform about the fact the currently ongoing\n \* new relay entry generation operation timed out. As a result, the group\n \* which was supposed to produce a new relay entry is immediately\n \* terminated and a new group is selected to produce a new relay entry.\

Vulnerable code:
```\n/\*\*\n \* @dev Function used to inform about the fact the currently ongoing\n \* new relay entry generation operation timed out. As a result, the group\n \* which was supposed to produce a new relay entry is immediately\n \* terminated and a new group is selected to produce a new relay entry.\n \* All members of the group are punished by seizing minimum stake of\n \* their tokens. The submitter of the transaction is rewarded with a\n \* tattletale reward which is limited to min(1, 20 / group\_size) of the\n \* maximum tattletale reward.\n \*/\nfunction reportRelayEntryTimeout() public {\n    require(hasEntryTimedOut(), "Entry did not time out");\n    groups.reportRelayEntryTimeout(signingRequest.groupIndex, groupSize, minimumStake);\n\n    // We could terminate the last active group. If that's the case,\n    // do not try to execute signing again because there is no group\n    // which can handle it.\n    if (numberOfGroups() > 0) {\n        signRelayEntry(\n            signingRequest.relayRequestId,\n            signingRequest.previousEntry,\n            signingRequest.serviceContract,\n            signingRequest.entryVerificationAndProfitFee,\n            signingRequest.callbackFee\n        );\n    }\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction \_withdrawReserves(address \_token, uint256 \_amount)\n    external\n    onlyOwner\n  . ```\nfunction \_withdrawReserves(address \_token, uint256 \_amount)\n    external\n    onlyOwner\n    onlyMSD(\_token)\n{\n    (uint256 \_equity, ) = calcEquity(\_token);\n\n    require(\_equity >= \_amount, "Token do not have enough reserve");\n\n    // Increase the token debt\n    msdTokenData[\_t

Vulnerable code:
```\nfunction \_withdrawReserves(address \_token, uint256 \_amount)\n    external\n    onlyOwner\n    onlyMSD(\_token)\n{\n    (uint256 \_equity, ) = calcEquity(\_token);\n\n    require(\_equity >= \_amount, "Token do not have enough reserve");\n\n    // Increase the token debt\n    msdTokenData[\_token].debt = msdTokenData[\_token].debt.add(\_amount);\n\n    // Directly mint the token to owner\n    MSD(\_token).mint(owner, \_amount);\n```\n
HIGH severity: Vulnerable function: ```\n  function lockCapital(address _lendingPoolAddress)\n    external\n    payable\n    override\n . ```\n  function lockCapital(address _lendingPoolAddress)\n    external\n    payable\n    override\n    onlyDefaultStateManager\n    whenNotPaused\n    returns (uint256 _lockedAmount, uint256 _snapshotId)\n  {\n// rest of code.\n    uint256 _length = activeProtectionIndexes.length();\n    for (uint25

Vulnerable code:
```\n  function lockCapital(address _lendingPoolAddress)\n    external\n    payable\n    override\n    onlyDefaultStateManager\n    whenNotPaused\n    returns (uint256 _lockedAmount, uint256 _snapshotId)\n  {\n// rest of code.\n    uint256 _length = activeProtectionIndexes.length();\n    for (uint256 i; i < _length; ) {\n// rest of code\n      uint256 _remainingPrincipal = poolInfo\n        .referenceLendingPools\n        .calculateRemainingPrincipal(            //<----------- calculate Remaining Principal\n          _lendingPoolAddress,\n          protectionInfo.buyer,\n          protectionInfo.purchaseParams.nftLpTokenId\n        );\n```\n
MEDIUM severity: Vulnerable function: ```\n   function emergencyClose(GMXTypes.Store storage self, uint256 deadline) external {\n        /. ```\n   function emergencyClose(GMXTypes.Store storage self, uint256 deadline) external {\n        // Revert if the status is Paused.\n        GMXChecks.beforeEmergencyCloseChecks(self);\n\n        // Repay all borrowed assets; 1e18 == 100% shareRatio to repay\n        GMXTypes.RepayParams memory _r

Vulnerable code:
```\n   function emergencyClose(GMXTypes.Store storage self, uint256 deadline) external {\n        // Revert if the status is Paused.\n        GMXChecks.beforeEmergencyCloseChecks(self);\n\n        // Repay all borrowed assets; 1e18 == 100% shareRatio to repay\n        GMXTypes.RepayParams memory _rp;\n        (_rp.repayTokenAAmt, _rp.repayTokenBAmt) = GMXManager.calcRepay(self, 1e18);\n\n        (bool _swapNeeded, address _tokenFrom, address _tokenTo, uint256 _tokenToAmt) =\n            GMXManager.calcSwapForRepay(self, _rp);\n\n        if (_swapNeeded) {\n            ISwap.SwapParams memory _sp;\n\n            _sp.tokenIn = _tokenFrom;\n            _sp.tokenOut = _tokenTo;\n            _sp.amountIn = IERC20(_tokenFrom).balanceOf(address(this));\n            _sp.amountOut = _tokenToAmt;\n            _sp.slippage = self.minSlippage;\n            _sp.deadline = deadline;\n\n            GMXManager.swapTokensForExactTokens(self, _sp);\n        }\n        GMXManager.repay(self, _rp.repayTokenAAmt, _rp.repayTokenBAmt);\n\n        self.status = GMXTypes.Status.Closed;\n\n        emit EmergencyClose(_rp.repayTokenAAmt, _rp.repayTokenBAmt);\n    }\n  }\n```\n
MEDIUM severity: Vulnerable function: ```\n    function _allowedBorrow(address from, uint256 share) internal virtual override {\n        i. ```\n    function _allowedBorrow(address from, uint256 share) internal virtual override {\n        if (from != msg.sender) {\n            // TODO review risk of using this\n            (uint256 pearlmitAllowed,) = penrose.pearlmit().allowance(from, msg.sender, address(yieldBox), collateralId);\n    

Vulnerable code:
```\n    function _allowedBorrow(address from, uint256 share) internal virtual override {\n        if (from != msg.sender) {\n            // TODO review risk of using this\n            (uint256 pearlmitAllowed,) = penrose.pearlmit().allowance(from, msg.sender, address(yieldBox), collateralId);\n            require(allowanceBorrow[from][msg.sender] >= share || pearlmitAllowed >= share, "Market: not approved");\n            if (allowanceBorrow[from][msg.sender] != type(uint256).max) {\n                allowanceBorrow[from][msg.sender] -= share;\n            }\n        }\n    }\n```\n
HIGH severity: Vulnerable function: ```\nFile: VaultAccountAction.sol\n    function settleVaultAccount(address account, address vault) e. ```\nFile: VaultAccountAction.sol\n    function settleVaultAccount(address account, address vault) external override nonReentrant {\n        requireValidAccount(account);\n        require(account != vault);\n\n        VaultConfig memory vaultConfig = VaultConfiguration.getVaultConfigStateful(vault);

Vulnerable code:
```\nFile: VaultAccountAction.sol\n    function settleVaultAccount(address account, address vault) external override nonReentrant {\n        requireValidAccount(account);\n        require(account != vault);\n\n        VaultConfig memory vaultConfig = VaultConfiguration.getVaultConfigStateful(vault);\n        VaultAccount memory vaultAccount = VaultAccountLib.getVaultAccount(account, vaultConfig);\n        \n        // Require that the account settled, otherwise we may leave the account in an unintended\n        // state in this method because we allow it to skip the min borrow check in the next line.\n        (bool didSettle, bool didTransfer) = vaultAccount.settleVaultAccount(vaultConfig);\n        require(didSettle, "No Settle");\n\n        vaultAccount.accruePrimeCashFeesToDebt(vaultConfig);\n\n        // Skip Min Borrow Check so that accounts can always be settled\n        vaultAccount.setVaultAccount({vaultConfig: vaultConfig, checkMinBorrow: false});\n\n        if (didTransfer) {\n            // If the vault did a transfer (i.e. withdrew cash) we have to check their collateral ratio. There\n            // is an edge condition where a vault with secondary borrows has an emergency exit. During that process\n            // an account will be left some cash balance in both currencies. It may have excess cash in one and\n            // insufficient cash in the other. A withdraw of the excess in one side will cause the vault account to\n            // be insolvent if we do not run this check. If this scenario indeed does occur, the vault itself must\n            // be upgraded in order to facilitate orderly exits for all of the accounts since they will be prevented\n            // from settling.\n            IVaultAccountHealth(address(this)).checkVaultAccountCollateralRatio(vault, account);\n        }\n    }\n```\n
HIGH severity: Vulnerable function: ```\n    params.minPrimary = poolContext._getTimeWeightedPrimaryBalance(\n      . ```\n    params.minPrimary = poolContext._getTimeWeightedPrimaryBalance(\n        oracleContext, strategyContext, bptToSettle\n    );\n\n    params.minPrimary = params.minPrimary * strategyContext.vaultSettings.balancerPoolSlippageLimitPercent / \n        uint256(BalancerConstants.VAULT_PERCENT_BASI

Vulnerable code:
```\n    params.minPrimary = poolContext._getTimeWeightedPrimaryBalance(\n        oracleContext, strategyContext, bptToSettle\n    );\n\n    params.minPrimary = params.minPrimary * strategyContext.vaultSettings.balancerPoolSlippageLimitPercent / \n        uint256(BalancerConstants.VAULT_PERCENT_BASIS);\n```\n
HIGH severity: Vulnerable function: ```\n        function addWithdrawRequest(uint256 _amountMLP, address _token) external {\n           . ```\n        function addWithdrawRequest(uint256 _amountMLP, address _token) external {\n            require(isAcceptingToken(_token), "ERROR: Invalid token");\n                require(_amountMLP != 0, "ERROR: Invalid amount");\n        \n        address _withdrawer = msg.sender;\n        // Get the

Vulnerable code:
```\n        function addWithdrawRequest(uint256 _amountMLP, address _token) external {\n            require(isAcceptingToken(_token), "ERROR: Invalid token");\n                require(_amountMLP != 0, "ERROR: Invalid amount");\n        \n        address _withdrawer = msg.sender;\n        // Get the pending buffer and staged buffer.\n             RequestBuffer storage _pendingBuffer = _requests(false);\n             RequestBuffer storage _stagedBuffer = _requests(true);\n        // Check if the withdrawer have enough balance to withdraw.\n        uint256 _bookedAmountMLP =  _stagedBuffer.withdrawAmountPerUser[_withdrawer] + \n       _pendingBuffer.withdrawAmountPerUser[_withdrawer];\n            require(_bookedAmountMLP + _amountMLP <= \n                MozaicLP(mozLP).balanceOf(_withdrawer), "Withdraw amount > amount  MLP");\n        …\n        emit WithdrawRequestAdded(_withdrawer, _token, chainId, _amountMLP);\n        }\n```\n
HIGH severity: Vulnerable function: ```\nthe oracle process:\n\n1. the oracle node checks the latest price from refe. ```\nthe oracle process:\n\n1. the oracle node checks the latest price from reference exchanges and stores it with the oracle node's timestamp, e.g. time: 1000\n2. the oracle node checks the latest block of the blockchain, e.g. block 100, it stores this with the oracle node's timestamp as well\n3. t

Vulnerable code:
```\nthe oracle process:\n\n1. the oracle node checks the latest price from reference exchanges and stores it with the oracle node's timestamp, e.g. time: 1000\n2. the oracle node checks the latest block of the blockchain, e.g. block 100, it stores this with the oracle node's timestamp as well\n3. the oracle node signs minOracleBlockNumber: 100, maxOracleBlockNumber: 100, timestamp: 1000, price: <price>\n4. the next time the loop runs is at time 1001, if the latest block of the blockchain is block 105, e.g. if 5 blocks were produced in that one second, then the oracle would sign\nminOracleBlockNumber: 101, maxOracleBlockNumber: 105, timestamp: 1001, price: <price>\n```\n
MEDIUM severity: Vulnerable function: ```\nfor (uint256 i = 0; i < \_teamsNumber; i++) {\n```\n. ```\nfor (uint256 i = 0; i < \_teamsNumber; i++) {\n```\n

Vulnerable code:
```\nfor (uint256 i = 0; i < \_teamsNumber; i++) {\n```\n
HIGH severity: Vulnerable function: ```\nif (validSignerCount <= target && validSignerCount != currentThreshold) {\n. ```\nif (validSignerCount <= target && validSignerCount != currentThreshold) {\n    newThreshold = validSignerCount;\n} else if (validSignerCount > target && currentThreshold < target) {\n    newThreshold = target;\n}\n```\n

Vulnerable code:
```\nif (validSignerCount <= target && validSignerCount != currentThreshold) {\n    newThreshold = validSignerCount;\n} else if (validSignerCount > target && currentThreshold < target) {\n    newThreshold = target;\n}\n```\n
HIGH severity: Vulnerable function: ```\n function test_audit_frontrunFlagShort() public {\n  address alice = makeAddr("Alice"); //Alice. ```\n function test_audit_frontrunFlagShort() public {\n  address alice = makeAddr("Alice"); //Alice will front-run Bob's attempt to flag her short\n  address aliceSecondAddr = makeAddr("AliceSecondAddr");\n  address bob = makeAddr("Bob"); //Bob will try to flag Alice's short \n  address randomUser 

Vulnerable code:
```\n function test_audit_frontrunFlagShort() public {\n  address alice = makeAddr("Alice"); //Alice will front-run Bob's attempt to flag her short\n  address aliceSecondAddr = makeAddr("AliceSecondAddr");\n  address bob = makeAddr("Bob"); //Bob will try to flag Alice's short \n  address randomUser = makeAddr("randomUser"); //regular user who created a bid order\n  \n  //A random user create a bid, Alice create a short, which will match with the user's bid\n  fundLimitBidOpt(DEFAULT_PRICE, DEFAULT_AMOUNT, randomUser);\n  fundLimitShortOpt(DEFAULT_PRICE, DEFAULT_AMOUNT, alice);\n  //Alice then mint the NFT associated to the SR so that it can be transfered\n  vm.prank(alice);\n  diamond.mintNFT(asset, Constants.SHORT_STARTING_ID);\n\n  //ETH price drops from 4000 to 2666, making Alice's short flaggable because its < LibAsset.primaryLiquidationCR(asset)\n  setETH(2666 ether);\n  \n  // Alice saw Bob attempt to flag her short, so she front-run him and transfer the SR\n  vm.prank(alice);\n  diamond.transferFrom(alice, aliceSecondAddr, 1);\n  \n  //Bob's attempt revert because the transfer of the short by Alice change the short status to SR.Cancelled\n  vm.prank(bob);\n  vm.expectRevert(Errors.InvalidShortId.selector);\n  diamond.flagShort(asset, alice, Constants.SHORT_STARTING_ID, Constants.HEAD);\n } \n```\n
HIGH severity: Vulnerable function: ```\n    function handleOutgoingRESDL(\n        address _sender,\n        uint256 _lockId,\n        . ```\n    function handleOutgoingRESDL(\n        address _sender,\n        uint256 _lockId,\n        address _sdlReceiver\n    )\n        external\n        onlyCCIPController\n        onlyLockOwner(_lockId, _sender)\n        updateRewards(_sender)\n        updateRewards(ccipController)\n        retur

Vulnerable code:
```\n    function handleOutgoingRESDL(\n        address _sender,\n        uint256 _lockId,\n        address _sdlReceiver\n    )\n        external\n        onlyCCIPController\n        onlyLockOwner(_lockId, _sender)\n        updateRewards(_sender)\n        updateRewards(ccipController)\n        returns (Lock memory)\n    {\n        Lock memory lock = locks[_lockId];\n\n        delete locks[_lockId].amount;\n        delete lockOwners[_lockId];\n        balances[_sender] -= 1;\n\n        uint256 totalAmount = lock.amount + lock.boostAmount;\n        effectiveBalances[_sender] -= totalAmount;\n        effectiveBalances[ccipController] += totalAmount;\n\n        sdlToken.safeTransfer(_sdlReceiver, lock.amount);\n\n        emit OutgoingRESDL(_sender, _lockId);\n\n        return lock;\n    }\n```\n