Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: The WooFi oracle's price validation process with Chainlink price feed is vulnerable to failure due t. The WooFi oracle's price validation process with Chainlink price feed is vulnerable to failure due to the potential for insufficient decimal precision. Specifically, when the quote token's price is extremely high or the base token's price is very low, the calculated price may result in a value of "0...

Vulnerable code:
```\nfunction _cloPriceInQuote(address _fromToken, address _toToken)\n    internal\n    view\n    returns (uint256 refPrice, uint256 refTimestamp)\n{\n    address baseOracle = clOracles[_fromToken].oracle;\n    if (baseOracle == address(0)) {\n        return (0, 0);\n    }\n    address quoteOracle = clOracles[_toToken].oracle;\n    uint8 quoteDecimal = clOracles[_toToken].decimal;\n\n    (, int256 rawBaseRefPrice,, uint256 baseUpdatedAt, ) = AggregatorV3Interface(baseOracle).latestRoundData();\n    (, int256 rawQuoteRefPrice,, uint256 quoteUpdatedAt, ) = AggregatorV3Interface(quoteOracle).latestRoundData();\n    uint256 baseRefPrice = uint256(rawBaseRefPrice);\n    uint256 quoteRefPrice = uint256(rawQuoteRefPrice);\n\n    uint256 ceoff = uint256(10)**quoteDecimal;\n    refPrice = (baseRefPrice * ceoff) / quoteRefPrice;\n    refTimestamp = baseUpdatedAt >= quoteUpdatedAt? quoteUpdatedAt : baseUpdatedAt;\n}\n```\n```\nbool woPriceInBound = \n    cloPrice_ == 0 || \n    ((cloPrice_ * (1e18 - bound)) / 1e18 <= woPrice_ && \n     woPrice_ <= (cloPrice_ * (1e18 + bound)) / 1e18);\n\nif (woFeasible) {\n    priceOut = woPrice_;\n    feasible = woPriceInBound;\n```
MEDIUM severity: The rate limiting mechanism implemented in the `L1MessageService` contract's `claimMessage` and `sen. The rate limiting mechanism implemented in the `L1MessageService` contract's `claimMessage` and `sendMessage` functions poses a significant risk to the usability and safety of users' funds. Specifically, the `_addUsedAmount` function restricts the amount of Ether that can be sent from L2 to L1 withi...

Vulnerable code:
```\naddUsedAmount(_fee + _value);\n```\n```\naddUsedAmount(msg.value)\n```\n```\nfunction _addUsedAmount(uint256 _usedAmount) internal {\n    uint256 currentPeriodAmountTemp;\n\n    if (currentPeriodEnd < block.timestamp) {\n        // Update period before proceeding\n        currentPeriodEnd = block.timestamp + periodInSeconds;\n        currentPeriodAmountTemp = _usedAmount;\n    } else {\n        currentPeriodAmountTemp = currentPeriodAmountInWei + _usedAmount;\n    }\n\n    if (currentPeriodAmountTemp > limitInWei) {\n        revert RateLimitExceeded();\n    }\n\n    currentPeriodAmountInWei = currentPeriodAmountTemp;\n}\n```
MEDIUM severity: When attempting to claim a message on the destination layer, if the message execution fails due to v. When attempting to claim a message on the destination layer, if the message execution fails due to various reasons, such as an incorrect target contract address, invalid contract logic, insufficient gas, or malicious contract behavior, the Ether sent using the `sendMessage` function on the original...

Vulnerable code:
```\nuint256 messageNumber = nextMessageNumber;\nuint256 valueSent = msg.value - _fee;\n\nbytes32 messageHash = keccak256(abi.encode(msg.sender, _to, _fee, valueSent, messageNumber, _calldata));\n```\n```\n(bool success, bytes memory returnData) = _to.call{ value: _value }(_calldata);\nif (!success) {\n    if (returnData.length > 0) {\n        assembly {\n            let data_size := mload(returnData)\n            revert(add(32, returnData), data_size)\n        }\n    } else {\n        revert MessageSendingFailed(_to);\n    }\n}\n```\n```\n(bool success, bytes memory returnData) = _to.call{ value: _value }(_calldata);\nif (!success) {\n    if (returnData.length > 0) {\n        assembly {\n            let data_size := mload(returnData)\n            revert(add(32, returnData), data_size)\n        }\n    } else {\n        revert MessageSendingFailed(_to);\n    }\n}\n```
MEDIUM severity: The NatSpec documentation in the code base contains inaccuracies and misleading information, which c. The NatSpec documentation in the code base contains inaccuracies and misleading information, which can lead to misunderstandings about the code's functionality, particularly among developers who rely on these comments for clarity and guidance. This issue is evident in the `RocketDAOProtocolProposal`...

Vulnerable code:
```\n/**\n@notice Get the votes against count of this proposal\n@param _proposalID The ID of the proposal to query\n*/\n```\n```\nfunction getReceiptDirection(uint256 _proposalID, address _nodeAddress) override public view returns (VoteDirection) {\n    return VoteDirection(getUint(keccak256(abi.encodePacked(\n        daoProposalNameSpace,\n        "receipt.direction",\n        _proposalID,\n        _nodeAddress\n    ))));\n}\n```\n```\n/**\n@notice Used by a verifier to challenge a specific index of a proposal's voting power tree\n@param _proposalID The ID of the proposal being challenged\n@param _index The global index of the node being challenged\n*/\n```
MEDIUM severity: This vulnerability occurs when a contract uses the `call()` function to interact with another contra. This vulnerability occurs when a contract uses the `call()` function to interact with another contract, but fails to specify a variable to store the returned data. This can lead to unintended exposure to gas griefing attacks, as the returned data is copied into memory, consuming gas and potentially...

Vulnerable code:
```\n(bool sent,) = _to.call(value: _amount, "");\nrequire(sent);\n```\n```\n(bool sent, bytes memory data) = _to.call{value: _amount}("");\nrequire(sent);\n```
MEDIUM severity: The `meta.tuneBelowCapacity` parameter is not updated when the `BondBaseSDA.setIntervals` function i. The `meta.tuneBelowCapacity` parameter is not updated when the `BondBaseSDA.setIntervals` function is called, which has a significant impact on the price tuning process. This parameter plays a crucial role in determining when the market is under or oversold, and its incorrect value can lead to inacc...

Vulnerable code:
```\nfunction setIntervals(uint256 id_, uint32[3] calldata intervals_) external override {\n    // Check that the market is live\n    if (!isLive(id_)) revert Auctioneer_InvalidParams();\n\n    // Check that the intervals are non-zero\n    if (intervals_[0] == 0 || intervals_[1] == 0 || intervals_[2] == 0)\n        revert Auctioneer_InvalidParams();\n\n    // Check that tuneInterval >= tuneAdjustmentDelay\n    if (intervals_[0] < intervals_[1]) revert Auctioneer_InvalidParams();\n\n    BondMetadata storage meta = metadata[id_];\n    // Check that tuneInterval >= depositInterval\n    if (intervals_[0] < meta.depositInterval) revert Auctioneer_InvalidParams();\n\n    // Check that debtDecayInterval >= minDebtDecayInterval\n    if (intervals_[2] < minDebtDecayInterval) revert Auctioneer_InvalidParams();\n\n    // Check that sender is market owner\n    BondMarket memory market = markets[id_];\n    if (msg.sender!= market.owner) revert Auctioneer_OnlyMarketOwner();\n\n    // Update intervals\n    meta.tuneInterval = intervals_[0];\n    meta.tuneIntervalCapacity = market.capacity.mulDiv(\n        uint256(intervals_[0]),\n        uint256(terms[id_].conclusion) - block.timestamp\n    ); // don't have a stored value for market duration, this will update tuneIntervalCapacity based on time remaining\n    meta.tuneAdjustmentDelay = intervals_[1];\n    meta.debtDecayInterval = intervals_[2];\n}\n```\n```\nif (\n    (market.capacity < meta.tuneBelowCapacity && timeNeutralCapacity < initialCapacity) ||\n    (time_ >= meta.lastTune + meta.tuneInterval && timeNeutralCapacity > initialCapacity)\n) {\n    markets[id_].maxPayout = capacity.mulDiv(uint256(meta.depositInterval), timeRemaining);\n\n    uint256 targetDebt = timeNeutralCapacity.mulDiv(\n        uint256(meta.debtDecayInterval),\n        uint256(meta.length)\n    );\n\n    uint256 controlVariable = terms[id_].controlVariable;\n    uint256 newControlVariable = price_.mulDivUp(market.scale, targetDebt);\n\n    emit Tuned(id_, controlVariable, newControlVariable);\n\n    if (newControlVariable < controlVariable) {\n        uint256 change = controlVariable - newControlVariable;\n        adjustments[id_] = Adjustment(change, time_, meta.tuneAdjustmentDelay, true);\n    } else {\n        terms[id_].controlVariable = newControlVariable;\n        adjustments[id_].active = false;\n    }\n\n    metadata[id_].lastTune = time_;\n    metadata[id_].tuneBelowCapacity = market.capacity > meta.tuneIntervalCapacity\n       ? market.capacity - meta.tuneIntervalCapacity\n        : 0;\n    metadata[id_].lastTuneDebt = targetDebt;\n}\n```
MEDIUM severity: The Bond Payment Factor (BPF) is a critical component in the calculation of rewards or penalties for. The Bond Payment Factor (BPF) is a critical component in the calculation of rewards or penalties for kickers in a `take` action. The BPF is determined by the formula outlined in the whitepaper, which involves the bond factor, neutral price, and auction price. The formula is designed to ensure that t...

Vulnerable code:
```\nif TP < NP:\n    BPF = bondFactor * min(1, max(-1, (NP - price) / (NP - TP)))\n```\n```\nfunction _bpf(\n    uint256 debt_,\n    uint256 collateral_,\n    uint256 neutralPrice_,\n    uint256 bondFactor_,\n    uint256 auctionPrice_\n) public pure returns (int256) {\n    int256 thresholdPrice = int256(Maths.wdiv(debt_, collateral_));\n\n    int256 sign;\n    if (thresholdPrice < int256(neutralPrice_)) {\n        sign = Maths.minInt(\n            1e18,\n            Maths.maxInt(\n                -1 * 1e18,\n                PRBMathSD59x18.div(\n                    int256(neutralPrice_) - int256(auctionPrice_),\n                    int256(neutralPrice_) - thresholdPrice\n                )\n            )\n        );\n    } else {\n        int256 val = int256(neutralPrice_) - int256(auctionPrice_);\n        if (val < 0) {\n            sign = -1e18;\n        } else if (val!= 0) {\n            sign = 1e18; // @audit Sign will be zero when NP = auctionPrice\n        }\n    }\n\n    return PRBMathSD59x18.mul(int256(bondFactor_), sign);\n}\n```
MEDIUM severity: The `removeLiquidityETH` function in the `DAOfiV1Router01` contract does not properly handle tokens . The `removeLiquidityETH` function in the `DAOfiV1Router01` contract does not properly handle tokens that do not return a boolean value when calling the `transfer()` or `transferFrom()` function. Specifically, if the base token does not return `true` when transferring the token, the function will thr...

Vulnerable code:
```\nfunction removeLiquidityETH(\n    LiquidityParams calldata lp,\n    uint deadline\n) external override ensure(deadline) returns (uint amountToken, uint amountETH) {\n    IDAOfiV1Pair pair = IDAOfiV1Pair(\n        DAOfiV1Library.pairFor(factory, lp.tokenBase, WETH, lp.slopeNumerator, lp.n, lp.fee)\n    );\n    require(msg.sender == pair.pairOwner(), 'DAOfiV1Router: FORBIDDEN');\n    (amountToken, amountETH) = pair.withdraw(address(this));\n    assert(IERC20(lp.tokenBase).transfer(lp.to, amountToken));\n    IWETH10(WETH).withdraw(amountETH);\n    TransferHelper.safeTransferETH(lp.to, amountETH);\n}\n```
MEDIUM severity: The vulnerability arises when a protocol is blacklisted due to unpredictable behavior of its exchang. The vulnerability arises when a protocol is blacklisted due to unpredictable behavior of its exchange price, resulting in unexpected rewards for users who have allocated tokens to that protocol during the rebalancing period. \n\nWhen a user allocates tokens to an underlying protocol, they receive re...

Vulnerable code:
```\nfunction storePriceAndRewards(uint256 _totalUnderlying, uint256 _protocolId) internal {\n    uint256 currentPrice = price(_protocolId);\n    if (lastPrices[_protocolId] == 0) {\n        lastPrices[_protocolId] = currentPrice;\n        return;\n    }\n\n    int256 priceDiff = int256(currentPrice - lastPrices[_protocolId]);\n    int256 nominator = (int256(_totalUnderlying * performanceFee) * priceDiff);\n    int256 totalAllocatedTokensRounded = totalAllocatedTokens / 1E18;\n    int256 denominator = totalAllocatedTokensRounded * int256(lastPrices[_protocolId]) * 100; // * 100 cause perfFee is in percentages\n\n    if (totalAllocatedTokensRounded == 0) {\n        rewardPerLockedToken[rebalancingPeriod][_protocolId] = 0;\n    } else {\n        rewardPerLockedToken[rebalancingPeriod][_protocolId] = nominator / denominator;\n    }\n\n    lastPrices[_protocolId] = currentPrice;\n}\n```
MEDIUM severity: The `percentBeansRecapped` and `percentLPRecapped` functions in the `LibUnripe` contract calculate t. The `percentBeansRecapped` and `percentLPRecapped` functions in the `LibUnripe` contract calculate the percentage of Unripe Beans and Unripe LPs that have been recapitalized, respectively. These percentages are calculated by dividing the balance of the Unripe Tokens by their total supply. However, t...

Vulnerable code:
```\nfunction percentBeansRecapped() internal view returns (uint256 percent) {\n    AppStorage storage s = LibAppStorage.diamondStorage();\n    return s.u[C.UNRIPE_BEAN].balanceOfUnderlying.mul(DECIMALS).div(C.unripeBean().totalSupply());\n}\n\n/**\n * @notice Returns the percentage that Unripe LP have been recapitalized.\n */\nfunction percentLPRecapped() internal view returns (uint256 percent) {\n    AppStorage storage s = LibAppStorage.diamondStorage();\n    return C.unripeLPPerDollar().mul(s.recapitalized).div(C.unripeLP().totalSupply());\n}\n```
MEDIUM severity: The BondingCurve contract's `allocate` function is vulnerable to a pre-launch minting attack. This f. The BondingCurve contract's `allocate` function is vulnerable to a pre-launch minting attack. This function is responsible for allocating the protocol's held PCV and subsequently calling the `_incentivize` function, which rewards the caller with FEI if a certain amount of time has passed. The `_ince...

Vulnerable code:
```\nfunction _incentivize() internal virtual {\n    if (isTimeEnded()) {\n        _initTimed(); // reset window\n        fei().mint(msg.sender, incentiveAmount);\n    }\n}\n```
MEDIUM severity: The `drawDebt` function is designed to prevent users from drawing debt below a certain threshold, kn. The `drawDebt` function is designed to prevent users from drawing debt below a certain threshold, known as `quoteDust_`. However, a logical error in the code allows for an edge case where a user can draw debt below this threshold. This occurs when there are 10 or more loans in the pool, and borrower...

Vulnerable code:
```\nfunction _revertOnMinDebt(\n    LoansState storage loans_,\n    uint256 poolDebt_,\n    uint256 borrowerDebt_,\n    uint256 quoteDust_\n) view {\n    if (borrowerDebt_!= 0) {\n        uint256 loansCount = Loans.noOfLoans(loans_);\n        if (loansCount >= 10) {\n            if (borrowerDebt_ < _minDebtAmount(poolDebt_, loansCount)) {\n                revert AmountLTMinDebt();\n            }\n        } else {\n            if (borrowerDebt_ < quoteDust_) {\n                revert DustAmountNotExceeded();\n            }\n        }\n    }\n}\n```\n```\nfunction _minDebtAmount(\n    uint256 debt_,\n    uint256 loansCount_\n) public returns (uint256 minDebtAmount_) {\n    if (loansCount_!= 0) {\n        minDebtAmount_ = Maths.wdiv(Maths.wdiv(debt_, Maths.wad(loansCount_)), 10**19);\n    }\n}\n```
MEDIUM severity: The `repay()` function in the borrowing contract is vulnerable to an underflow due to an incorrect c. The `repay()` function in the borrowing contract is vulnerable to an underflow due to an incorrect calculation of the `accLoanRatePerSeconds` variable. This variable is used to compute the missing collateral when a lender calls the `repay()` function to settle an outstanding loan. The issue arises w...

Vulnerable code:
```\nit("Updated accRate is incorrect", async () => {\n    const amountWBTC = ethers.utils.parseUnits("0.05", 8); // token0\n    let deadline = (await time.latest()) + 60;\n    const minLeverageDesired = 50;\n    const maxCollateralWBTC = amountWBTC.div(minLeverageDesired);\n\n    const loans = [\n        {\n            liquidity: nftpos[3].liquidity,\n            tokenId: nftpos[3].tokenId,\n        },\n        {\n            liquidity: nftpos[5].liquidity,\n            tokenId: nftpos[5].tokenId,\n        },\n    ];\n\n    const swapParams: ApproveSwapAndPay.SwapParamsStruct = {\n        swapTarget: constants.AddressZero,\n        swapAmountInDataIndex: 0,\n        maxGasForCall: 0,\n        swapData: swapData,\n    };\n\n    const borrowParams = {\n        internalSwapPoolfee: 500,\n        saleToken: WETH_ADDRESS,\n        holdToken: WBTC_ADDRESS,\n        minHoldTokenOut: amountWBTC,\n        maxCollateral: maxCollateralWBTC,\n        externalSwap: swapParams,\n        loans: loans,\n    };\n\n    await borrowingManager.connect(bob).borrow(borrowParams, deadline);\n\n    await time.increase(3600 * 72); // 72h so 2 days of missing collateral\n    deadline = (await time.latest()) + 60;\n\n    const borrowingKey = await borrowingManager.userBorrowingKeys(bob.address, 0);\n\n    let repayParams = {\n        isEmergency: true,\n        internalSwapPoolfee: 0,\n        externalSwap: swapParams,\n        borrowingKey: borrowingKey,\n        swapSlippageBP1000: 0,\n    };\n\n    const oldBorrowingInfo = await borrowingManager.borrowingsInfo(borrowingKey);\n    const dailyRateCollateral = await borrowingManager.checkDailyRateCollateral(borrowingKey);\n\n    await expect(borrowingManager.connect(alice).repay(repayParams, deadline)).to.be.revertedWithPanic();\n});\n```
MEDIUM severity: The `HatsSignerGate` and `MultiHatsSignerGate` functions allow users to become signers, but they fai. The `HatsSignerGate` and `MultiHatsSignerGate` functions allow users to become signers, but they fail to enforce a crucial limitation. Specifically, they do not prevent the number of valid signers from exceeding the `maxSigners` threshold. This vulnerability can lead to a denial-of-service (DoS) sce...

Vulnerable code:
```\nif (currentSignerCount >= maxSigs) {\n    revert MaxSignersReached();\n}\n\nif (safe.isOwner(msg.sender)) {\n    revert SignerAlreadyClaimed(msg.sender);\n}\n\nif (!isValidSigner(msg.sender)) {\n    revert NotSignerHatWearer(msg.sender);\n}\n```\n```\nfunction reconcileSignerCount() public {\n    address[] memory owners = safe.getOwners();\n    uint256 validSignerCount = _countValidSigners(owners);\n\n    if (validSignerCount > maxSigners) {\n        revert MaxSignersReached();\n    }\n```
MEDIUM severity: The vulnerability is a logic error in the `Curve2TokenConvexVault` contract, specifically in the `in. The vulnerability is a logic error in the `Curve2TokenConvexVault` contract, specifically in the `initialize` function. The issue arises from the incorrect assumption that the `PRIMARY_TOKEN` or `SECONDARY_TOKEN` will be equal to `Deployments.ALT_ETH_ADDRESS` (0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeE...

Vulnerable code:
```\nFile: Curve2TokenPoolMixin.sol\n\nabstract contract Curve2TokenPoolMixin is CurvePoolMixin {\n    constructor(\n        NotionalProxy notional_,\n        ConvexVaultDeploymentParams memory params\n    ) CurvePoolMixin(notional_, params) {\n        address primaryToken = _getNotionalUnderlyingToken(params.baseParams.primaryBorrowCurrencyId);\n\n        PRIMARY_TOKEN = primaryToken;\n\n        if (primaryToken == Deployments.ETH_ADDRESS) {\n            primaryToken = Deployments.ALT_ETH_ADDRESS;\n        }\n\n        address token0 = CURVE_POOL.coins(0);\n        address token1 = CURVE_POOL.coins(1);\n\n        uint8 primaryIndex;\n        address secondaryToken;\n        if (token0 == primaryToken) {\n            primaryIndex = 0;\n            secondaryToken = token1;\n        } else {\n            primaryIndex = 1;\n            secondaryToken = token0;\n        }\n\n        if (secondaryToken == Deployments.ALT_ETH_ADDRESS) {\n            secondaryToken = Deployments.ETH_ADDRESS;\n        }\n\n        PRIMARY_INDEX = primaryIndex;\n        SECONDARY_TOKEN = secondaryToken;\n```\n```\ncontract Curve2TokenConvexVault is Curve2TokenVaultMixin {\n    function initialize(InitParams calldata params)\n        external\n        initializer\n        onlyNotionalOwner\n    {\n        __INIT_VAULT(params.name, params.borrowCurrencyId);\n        CurveVaultStorage.setStrategyVaultSettings(params.settings);\n\n        if (PRIMARY_TOKEN!= Deployments.ALT_ETH_ADDRESS) {\n            IERC20(PRIMARY_TOKEN).checkApprove(address(CURVE_POOL), type(uint256).max);\n        }\n        if (SECONDARY_TOKEN!= Deployments.ALT_ETH_ADDRESS) {\n            IERC20(SECONDARY_TOKEN).checkApprove(address(CURVE_POOL), type(uint256).max);\n        }\n\n        CURVE_POOL_TOKEN.checkApprove(address(CONVEX_BOOSTER), type(uint256).max);\n    }\n```
MEDIUM severity: The vulnerability allows an attacker to manipulate the `processWithdraw` function in the GMXWithdraw. The vulnerability allows an attacker to manipulate the `processWithdraw` function in the GMXWithdraw.sol contract, causing it to revert. This occurs when a user initiates a withdrawal, and before the Vault Shares are burned, the attacker transfers the shares away from the user's address. As a result...

Vulnerable code:
```\nFile: GMXWithdraw.sol\nself.vault.burn(\n    self.withdrawCache.user,\n    self.withdrawCache.withdrawParams.shareAmt\n)\n```\n```\n// SPDX-License-Identifier: MIT\n\npragma solidity 0.8.21;\n\nimport { console, console2 } from "forge-std/Test.sol";\nimport { TestUtils } from "../../helpers/TestUtils.sol";\nimport { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";\nimport { IERC20Errors } from "@openzeppelin/contracts/interfaces/draft-IERC6093.sol";\nimport { GMXMockVaultSetup } from "./GMXMockVaultSetup.t.sol";\nimport { GMXTypes } from "../../../contracts/strategy/gmx/GMXTypes.sol";\nimport { GMXTestHelper } from "./GMXTestHelper.sol";\n\nimport { IDeposit } from "../../../contracts/interfaces/protocols/gmx/IDeposit.sol";\nimport { IEvent } from "../../../contracts/interfaces/protocols/gmx/IEvent.sol";\nimport { Attacker } from "./Attacker.sol";\n\ncontract GMXDepositTest is GMXMockVaultSetup, GMXTestHelper, TestUtils {\n    function test_POC4() public {\n        vm.startPrank(address(owner));\n        _createAndExecuteDeposit(address(WETH), address(USDC), address(WETH), 10 ether, 0, SLIPPAGE, EXECUTION_FEE);\n        vm.stopPrank();\n\n        vm.startPrank(address(user1));\n        _createAndExecuteDeposit(address(WETH), address(USDC), address(WETH), 10 ether, 0, SLIPPAGE, EXECUTION_FEE);\n        vm.stopPrank();\n\n        uint256 vaultSharesAmt = IERC20(address(vault)).balanceOf(address(user1)); // Vault Shares from user1 to withdraw\n        vm.startPrank(address(user1));\n        _createWithdrawal(address(USDC), vaultSharesAmt, 0, SLIPPAGE, EXECUTION_FEE); // User 1 creates a withdrawal\n        IERC20(address(vault)).transfer(address(user2), vaultSharesAmt); // Before processWithdraw is executed and the user's Vault Shares are burned, he sends them away\n\n        vm.expectRevert(\n            abi.encodeWithSelector(IERC20Errors.ERC20InsufficientBalance.selector, address(user1), 0, vaultSharesAmt)\n        );\n        mockExchangeRouter.executeWithdrawal(address(WETH), address(USDC), address(vault), address(callback)); // executeWithdraw reverted as there are no tokens to burn\n        vm.stopPrank();\n\n        GMXTypes.Store memory _store =\n```
MEDIUM severity: The GeneralRepay#repayJUSD function in JUSDBank's smart contract exhibits a vulnerability when repay. The GeneralRepay#repayJUSD function in JUSDBank's smart contract exhibits a vulnerability when repaying a position. Specifically, when there is an excess amount of USDC tokens, they are sent to the `to` address, which is intended to receive the repayment. However, this behavior is problematic when r...

Vulnerable code:
```\nIERC20(USDC).approve(jusdExchange, borrowBalance);\n    IJUSDExchange(jusdExchange).buyJUSD(borrowBalance, address(this));\n    IERC20(USDC).safeTransfer(to, USDCAmount - borrowBalance);\n    JUSDAmount = borrowBalance;\n```