Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: The vulnerability allows an account that confirms a transaction via AssetProxyOwner to indefinitely . The vulnerability allows an account that confirms a transaction via AssetProxyOwner to indefinitely block that transaction. This occurs when an owner confirms a transaction and then revokes their confirmation before the time lock has elapsed. The owner can repeatedly revoke and reconfirm the transac...

Vulnerable code:
```\nfunction confirmTransaction(uint256 transactionId)\n    public\n    ownerExists(msg.sender)\n    transactionExists(transactionId)\n    notConfirmed(transactionId, msg.sender)\n    notFullyConfirmed(transactionId)\n{\n    confirmations[transactionId][msg.sender] = true;\n    emit Confirmation(msg.sender, transactionId);\n    if (isConfirmed(transactionId)) {\n        _setConfirmationTime(transactionId, block.timestamp);\n    }\n}\n```\n```\nfunction revokeConfirmation(uint256 transactionId)\n    public\n    ownerExists(msg.sender)\n    confirmed(transactionId, msg.sender)\n    notExecuted(transactionId)\n{\n    confirmations[transactionId][msg.sender] = false;\n    emit Revocation(msg.sender, transactionId);\n}\n```
MEDIUM severity: This vulnerability occurs when slashes are processed by a holder, which results in an unexpected beh. This vulnerability occurs when slashes are processed by a holder, which results in an unexpected behavior regarding the distribution of bounties amongst delegators. Specifically, the `_delegatedByHolderToValidator` and `_delegatedByHolder` values are reduced as expected, but the `_effectiveDelegated...

Vulnerable code:
```\nuint oldValue = getAndUpdateDelegatedByHolderToValidator(holder, validatorId);\n\nif (oldValue > 0) {\n    uint month = _slashes[index].month;\n    reduce(\n        _delegatedByHolderToValidator[holder][validatorId],\n        _delegatedByHolder[holder],\n        _slashes[index].reducingCoefficient,\n        month\n    );\n    slashingSignals[index.sub(begin)].holder = holder;\n    slashingSignals[index.sub(begin)].penalty = oldValue.sub(getAndUpdateDelegatedByHolderToValidator(holder, validatorId));\n}\n```
MEDIUM severity: The `PolicyQuote` contract's `getQuote` function is responsible for calculating the quote for a poli. The `PolicyQuote` contract's `getQuote` function is responsible for calculating the quote for a policy purchase. When a policy is bought, the `_buyPolicyFor` function requests a quote from `getQuote`, which in turn calls the internal `_getQuote` function. The `_getQuote` function calculates the quot...

Vulnerable code:
```\nfunction _buyPolicyFor(\n    address _policyHolderAddr,\n    uint256 _epochsNumber,\n    uint256 _coverTokens\n) internal {\n```\n```\nuint256 _totalPrice = policyQuote.getQuote(_totalSeconds, _coverTokens, address(this));\n```\n```\nfunction getQuote(uint256 _durationSeconds, uint256 _tokens, address _policyBookAddr)\n  external\n  view\n  override\n  returns (uint256 _daiTokens)\n{\n  _daiTokens = _getQuote(_durationSeconds, _tokens, _policyBookAddr);\n}\n```\n```\nfunction _getQuote(uint256 _durationSeconds, uint256 _tokens, address _policyBookAddr)\n  internal\n  view\n  returns (uint256)\n{\n```\n```\nrequire(_totalCoverTokens.add(_tokens) <= _totalLiquidity, "PolicyBook: Requiring more than there exists");\nrequire(_totalLiquidity > 0, "PolicyBook: The pool is empty");\n```
MEDIUM severity: The `depositProfitTokenForUsers()` function in Ninja vaults' delegated strategy is vulnerable to a c. The `depositProfitTokenForUsers()` function in Ninja vaults' delegated strategy is vulnerable to a compatibility issue with a significant number of ERC20 tokens. The function attempts to transfer profit tokens to the vault using the `transferFrom()` method, which is not wrapped with the `safeTransfe...

Vulnerable code:
```\nif (/* Now pull in the tokens (Should have permission) */) {\n    // We only want to pull the tokens with accounting\n    profitToken.transferFrom(strategy, address(this), _amount);\n    emit ProfitReceivedFromStrategy(_amount);\n```
MEDIUM severity: The vulnerability lies in the way presale opening dates are assigned and managed. There are two poss. The vulnerability lies in the way presale opening dates are assigned and managed. There are two possible scenarios for assigning the opening date: either it is defined during initialization or it is set to occur when the `open()` function is executed. \n\nThe issue arises from the fact that even if...

Vulnerable code:
```\nif (_openDate!= 0) {\n    _setOpenDate(_openDate);\n}\n```\n```\nfunction open() external auth(OPEN_ROLE) {\n    require(state() == State.Pending, ERROR_INVALID_STATE);\n\n    _open();\n}\n```
MEDIUM severity: The `Gateway` contract, responsible for facilitating meta transactions and batched transactions, is . The `Gateway` contract, responsible for facilitating meta transactions and batched transactions, is designed to interact with specific contracts that implement the `GatewayRecipient` interface. However, the current implementation allows the `Gateway` contract to call any contract, without any restri...

Vulnerable code:
```\nfor (uint256 i = 0; i < data.length; i++) {\n    require(to[i]!= address(0));\n    (succeeded,) = to[i].call(abi.encodePacked(data[i], account, sender));\n    require(succeeded);\n}\n```
MEDIUM severity: The `matchOrders` function in the provided smart contract is vulnerable to insufficient input valida. The `matchOrders` function in the provided smart contract is vulnerable to insufficient input validation, which can lead to unexpected behavior and potential security issues. Specifically, the function does not adequately check the consistency between the number of `amounts` provided and the number...

Vulnerable code:
```\nfunction matchOrders(\n    LibOrder.OrderParam memory takerOrderParam,\n    LibOrder.OrderParam[] memory makerOrderParams,\n    address _perpetual,\n    uint256[] memory amounts\n) public {\n    //...\n```\n```\nfunction matchOrderWithAMM(\n    LibOrder.OrderParam memory takerOrderParam,\n    address _perpetual,\n    uint256 amount\n) public {\n    //...\n```
MEDIUM severity: The `LiquidutyMining` contract contains two loops that iterate over state arrays, specifically `lead. The `LiquidutyMining` contract contains two loops that iterate over state arrays, specifically `leaderboard` and `topUsers`. These loops utilize a traditional indexing approach, incrementing a counter `i` to traverse the array elements. However, this approach can lead to unnecessary gas consumption...

Vulnerable code:
```\nfor (uint256 i = 0; i < leaderboard.length; i++) {\n    // Code here\n}\n```\n```\nfor (uint256 i = 0; i < topUsers.length; i++) {\n    // Code here\n}\n```\n```\nuint256 _usersNumber = allUsers.length;\n```\n```\nfor (uint256 i = 0; i < _usersNumber; i++) {\n```
MEDIUM severity: The Oracle-based system, which relies on the Chainlink oracle for index price information, is vulner. The Oracle-based system, which relies on the Chainlink oracle for index price information, is vulnerable to potential issues arising from unchecked oracle response timestamps and integer over/underflow. The `ChainlinkAdapter` and `InversedChainlinkAdapter` classes, responsible for processing the ora...

Vulnerable code:
```\nint256 public constant chainlinkDecimalsAdapter = 10 ** 10;\n\nconstructor(address _feeder) public {\n    feeder = IChainlinkFeeder(_feeder);\n}\n\nfunction price() public view returns (uint256 newPrice, uint256 timestamp) {\n    newPrice = (feeder.latestAnswer() * chainlinkDecimalsAdapter).toUint256();\n    timestamp = feeder.latestTimestamp();\n}\n```\n```\nint256 public constant chainlinkDecimalsAdapter = 10 ** 10;\n\nconstructor(address _feeder) public {\n    feeder = IChainlinkFeeder(_feeder);\n}\n\nfunction price() public view returns (uint256 newPrice, uint256 timestamp) {\n    newPrice = ONE.div(feeder.latestAnswer() * chainlinkDecimalsAdapter).toUint256();\n    timestamp = feeder.latestTimestamp();\n}\n```\n```\ntimestamp = feeder.latestTimestamp();\n```
MEDIUM severity: The `feeManager` in the configuration is cached during the initialization of the bank, which can lea. The `feeManager` in the configuration is cached during the initialization of the bank, which can lead to a desynchronization between the bank and vaults. This occurs because the cached `feeManager` address is not updated when the configuration is modified, resulting in a stale value being used.\n\nW...

Vulnerable code:
```\nfeeManager = config_.feeManager();\n```\n```\nwithdrawAmount = config.feeManager().doCutVaultWithdrawFee(\n    address(uToken),\n    shareAmount\n)\n```
MEDIUM severity: The vulnerability lies in the lack of stale price checks in oracle calls, specifically in the `Stabl. The vulnerability lies in the lack of stale price checks in oracle calls, specifically in the `StableOracleDAI.getPriceUSD()` function. This function retrieves the latest round data from the `priceFeedDAIETH` oracle, which may not always reflect the current market price. The calculation performed in...

Vulnerable code:
```\n(\n    int256 price,\n    uint256 wethPriceUSD,\n    uint256 DAIWethPrice,\n    uint256 roundData\n) = priceFeedDAIETH.latestRoundData();\n\nreturn\n    (wethPriceUSD * 1e18) /\n    ((DAIWethPrice + uint256(price) * 1e10) / 2);\n```
MEDIUM severity: The `getReservesByCategory()` function in the `SPPLYv1` contract is vulnerable to a reversion when `. The `getReservesByCategory()` function in the `SPPLYv1` contract is vulnerable to a reversion when `useSubmodules` is set to `true` and `submoduleReservesSelector` is set to `bytes4(0)`. This occurs because the function does not check if `submoduleReservesSelector` is not empty before calling the `s...

Vulnerable code:
```\n_addCategory(toCategory("protocol-owned-treasury"), true, 0xb600c5e2, 0x00000000);\n```\n```\nfunction getReservesByCategory(\n    Category category_\n) external view override returns (Reserves[] memory) {\n    // If category requires data from submodules, count all submodules and their sources.\n    uint256 len = (data.useSubmodules)? submodules.length : 0;\n\n    for (uint256 i = 0; i < len; i++) {\n        address submodule = address(_getSubmoduleIfInstalled(submodules[i]));\n        (bool success, bytes memory returnData) = submodule.staticcall(\n            abi.encodeWithSelector(data.submoduleReservesSelector)\n        );\n}\n```\n```\nfunction test_getReservesByCategory_includesSubmodules_treasury() public {\n    _setUpSubmodules();\n\n    ohm.mint(address(treasuryAddress), 100e9);\n    gohm.mint(address(treasuryAddress), 1e18); // 1 gOHM\n\n    // Categories already defined\n\n    uint256 expectedBptDai = BPT_BALANCE.mulDiv(\n        BALANCER_POOL_DAI_BALANCE,\n        BALANCER_POOL_TOTAL_SUPPLY\n    );\n\n    uint256 expectedBptOhm = BPT_BALANCE.mulDiv(\n        BALANCER_POOL_OHM_BALANCE,\n        BALANCER_POOL_TOTAL_SUPPLY\n    );\n\n    // Check reserves\n    SPPLYv1.Reserves[] memory reserves = moduleSupply.getReservesByCategory(\n        toCategory("protocol-owned-treasury")\n    );\n}\n```\n```\nforge test -vv --match-test test_getReservesByCategory_includesSubmodules_treasury\n\nRunning 1 test for src/test/modules/SPPLY/SPPLY.v1.t.sol:SupplyTest\n[FAIL. Reason: SPPLY_SubmoduleFailed(0xeb502B1d35e975321B21cCE0E8890d20a7Eb289d, 0x0000000000000000000000000000000000000000000000000000000000000000)]\ntest_getReservesByCategory_includesSubmodules_treasury() (gas: 4774197)\n```
MEDIUM severity: The `LendingPool#flashAction` function is designed to facilitate refinancing of positions across len. The `LendingPool#flashAction` function is designed to facilitate refinancing of positions across lending pools. However, a critical issue arises when attempting to refinance an account, as the `updateActionTimestampByCreditor` function is not properly controlled. Specifically, the `updateActionTimes...

Vulnerable code:
```\nIAccount(account).updateActionTimestampByCreditor();\n\nasset.safeTransfer(actionTarget, amountBorrowed);\n\n{\n    uint256 accountVersion = IAccount(account).flashActionByCreditor(actionTarget, actionData);\n    if (!isValidVersion[accountVersion]) {\n        revert LendingPoolErrors.InvalidVersion();\n    }\n}\n```\n```\nfunction updateActionTimestampByCreditor() external onlyCreditor {\n    updateActionTimestamp\n}\n```
MEDIUM severity: The vulnerability lies in the way Notional's rebalancing process interacts with multiple external mo. The vulnerability lies in the way Notional's rebalancing process interacts with multiple external money markets. Specifically, the `ProportionalRebalancingStrategy` function iterates through all holdings and performs deposits or redemptions against each external market. This process is vulnerable to...

Vulnerable code:
```\nFile: ProportionalRebalancingStrategy.sol\n\nfunction calculateRebalance(\n    IPrimeCashHoldingsOracle oracle,\n    uint8[] calldata rebalancingTargets\n) external view override onlyNotional returns (RebalancingData memory rebalancingData) {\n    address[] memory holdings = oracle.holdings();\n\n    for (uint256 i = 0; i < holdings.length; i++) {\n        address holding = holdings[i];\n        uint256 targetAmount = totalValue * rebalancingTargets[i] / uint256(Constants.PERCENTAGE_DECIMALS);\n        uint256 currentAmount = values[i];\n\n        redeemHoldings[i] = holding;\n        depositHoldings[i] = holding;\n    }\n\n    rebalancingData.redeemData = oracle.getRedemptionCalldataForRebalancing(redeemHoldings, redeemAmounts);\n    rebalancingData.depositData = oracle.getDepositCalldataForRebalancing(depositHoldings, depositAmounts);\n}\n```\n```\nFile: TreasuryAction.sol\n\nfunction _executeDeposits(Token memory underlyingToken, DepositData[] memory deposits) private {\n    //...SNIP...\n    for (uint256 j; j < depositData.targets.length; ++j) {\n        // This will revert if the individual call reverts.\n        GenericToken.executeLowLevelCall(\n            depositData.targets[j],\n            depositData.msgValue[j],\n            depositData.callData[j]\n        );\n    }\n```\n```\nFile: TokenHandler.sol\n\nfunction executeMoneyMarketRedemptions(\n    //...SNIP...\n    ) internal {\n    for (uint256 j; j < data.targets.length; j++) {\n        // This will revert if the individual call reverts.\n        GenericToken.executeLowLevelCall(data.targets[j], 0, data.callData[j]);\n    }\n```
MEDIUM severity: The vulnerability in the TBTC deposit lifecycle management system lies in the lack of enforced state. The vulnerability in the TBTC deposit lifecycle management system lies in the lack of enforced state transitions. The system's state machine is designed to ensure that deposits are correctly funded before minting TBTC tokens. However, the system does not guarantee that participants will always progr...

Vulnerable code:
```\nfunction retrieveSignerPubkey(DepositUtils.Deposit storage _d) public {\n    require(_d.inAwaitingSignerSetup(), "Not currently awaiting signer setup");\n\n    bytes memory _publicKey = IBondedECDSAKeep(_d.keepAddress).getPublicKey();\n    require(_publicKey.length == 64, "public key not set or not 64-bytes long");\n```\n```\nfunction provideBTCFundingProof(\n    DepositUtils.Deposit storage _d,\n    bytes4 _txVersion,\n    bytes memory _txInputVector,\n    bytes memory _txOutputVector,\n    bytes4 _txLocktime,\n    uint8 _fundingOutputIndex,\n    bytes memory _merkleProof,\n    uint256 _txIndexInBlock,\n    bytes memory _bitcoinHeaders\n) public returns (bool) {\n    require(_d.inAwaitingBTCFundingProof(), "Not awaiting funding");\n\n    bytes8 _valueBytes;\n    bytes memory _utxoOutpoint;\n```\n```\nfunction exitCourtesyCall(DepositUtils.Deposit storage _d) public {\n    require(_d.inCourtesyCall(), "Not currently in courtesy call");\n    require(block.timestamp <= _d.fundedAt + TBTCConstants.getDepositTerm(), "Deposit is expiring");\n    require(getCollateralizationPercentage(_d) >= _d.undercollateralizedThresholdPercent, "Deposit is still undercollateralized");\n    _d.setActive();\n    _d.logExitedCourtesyCall();\n}\n```\n```\nfunction notifyDepositExpiryCourtesyCall(DepositUtils.Deposit storage _d) public {\n    require(_d.inActive(), "Deposit is not active");\n    require(block.timestamp >= _d.fundedAt + TBTCConstants.getDepositTerm(), "Deposit term not elapsed");\n    _d.setCourtesyCall();\n    _d.logCourtesyCalled();\n    _d.courtesyCallInitiated = block.timestamp;\n}\n```
MEDIUM severity: The `_buildCCIPMessage()` function in the WrappedTokenBridge contract's implementation of cross-chai. The `_buildCCIPMessage()` function in the WrappedTokenBridge contract's implementation of cross-chain message processing lacks a crucial specification for the gas limit required for the execution of the `ccipReceive()` function on the destination blockchain. This oversight can lead to unpredictable...

Vulnerable code:
```\nClient.EVM2AnyMessage memory evm2AnyMessage = \n    Client.EVM2AnyMessage({\n        receiver: abi.encode(_receiver),\n        data: "",\n        tokenAmounts: tokenAmounts,\n        extraArgs: "0x",\n        feeToken: _feeTokenAddress\n    });\n\nreturn evm2AnyMessage;\n```
MEDIUM severity: The `updateDebtReporting` function in the LMPVault contract allows an attacker to manipulate the deb. The `updateDebtReporting` function in the LMPVault contract allows an attacker to manipulate the debt reporting process, leading to a scenario where the attacker can profit from the loss incurred by other users. This vulnerability occurs when an attacker updates the debt reporting for a specific des...

Vulnerable code:
```\nforge test --match-path test/vault/LMPVault-Withdraw.t.sol --match-test test_AvoidTheLoss -vv\n```\n```\nfunction test_AvoidTheLoss() public {\n    _accessController.grantRole(Roles.SOLVER_ROLE, address(this));\n    _accessController.grantRole(Roles.LMP_FEE_SETTER_ROLE, address(this));\n\n    address feeSink = vm.addr(555);\n    _lmpVault.setFeeSink(feeSink);\n    _lmpVault.setPerformanceFeeBps(2000); // 20%\n\n    address alice = address(789);\n    uint initialBalanceAlice = 1000;\n\n    _asset.mint(address(this), 1000);\n    _asset.approve(address(_lmpVault), 1000);\n    uint shareBalUser = _lmpVault.deposit(1000, address(this));\n\n    _underlyerOne.mint(address(this), 500);\n    _underlyerOne.approve(address(_lmpVault), 500);\n    _lmpVault.rebalance(\n        address(_destVaultOne),\n        address(_underlyerOne),\n        500,\n        address(0),\n        address(_asset),\n        1000\n    );\n\n    _asset.mint(alice, initialBalanceAlice);\n    vm.startPrank(alice);\n    _asset.approve(address(_lmpVault), initialBalanceAlice);\n    uint shareBalAlice = _lmpVault.deposit(initialBalanceAlice, alice);\n    vm.stopPrank();\n\n    _underlyerTwo.mint(address(this), 1000);\n    _underlyerTwo.approve(address(_lmpVault), 1000);\n    _lmpVault.rebalance(\n        address(_destVaultTwo),\n        address(_underlyerTwo),\n        1000,\n        address(0),\n        address(_asset),\n        1000\n    );\n\n    _mockRootPrice(address(_underlyerTwo), 0.9 ether);\n    _mockRootPrice(address(_underlyerOne), 2.1 ether);\n\n    address[] memory alteredDestinations = new address[](1);\n    alteredDestinations[0] = address(_destVaultOne);\n    vm.prank(alice);\n    _lmpVault.updateDebtReporting(alteredDestinations);\n\n    vm.prank(alice);\n    _lmpVault.redeem(shareBalAlice, alice, alice);\n    uint finalBalanceAlice = _asset.balanceOf(alice);\n    emit log_named_uint("final Balance of alice", finalBalanceAlice);\n\n    emit log_named_uint("Fees shares give to feeSink", _l\n```
MEDIUM severity: The withdrawal queue is not updated in a timely manner, which can lead to a situation where users ar. The withdrawal queue is not updated in a timely manner, which can lead to a situation where users are unable to withdraw liquidity. This occurs when the amount of liquidity is not significantly higher than the number of tokens locked for collateral. In such cases, a withdrawal request is created, bu...

Vulnerable code:
```\nfunction _addLiquidityFor(address _liquidityHolderAddr, uint256 _liquidityAmount, bool _isLM) internal {\n    daiToken.transferFrom(_liquidityHolderAddr, address(this), _liquidityAmount);\n\n    uint256 _amountToMint = _liquidityAmount.mul(PERCENTAGE_100).div(getDAIToDAIxRatio());\n    totalLiquidity = totalLiquidity.add(_liquidityAmount);\n    _mintERC20(_liquidityHolderAddr, _amountToMint);\n\n    if (_isLM) {\n        liquidityFromLM[_liquidityHolderAddr] = liquidityFromLM[_liquidityHolderAddr].add(_liquidityAmount);\n    }\n\n    _updateWithdrawalQueue();\n\n    emit AddLiquidity(_liquidityHolderAddr, _liquidityAmount, totalLiquidity);\n}\n```
MEDIUM severity: The `SGLLeverage.sellCollateral` function, and its counterpart `BBLeverage.sellCollateral`, contain . The `SGLLeverage.sellCollateral` function, and its counterpart `BBLeverage.sellCollateral`, contain a critical flaw in their calculation of the `leverageAmount` variable. This variable is used to determine the amount of asset tokens to be swapped for collateral tokens after the withdrawal of collate...

Vulnerable code:
```\nyieldBox.withdraw(\n    collateralId,\n    address(this),\n    address(leverageExecutor),\n    0,\n    calldata_.share\n);\n\nuint256 leverageAmount = yieldBox.toAmount(\n    collateralId,\n    calldata_.share,\n    false\n);\n\namountOut = leverageExecutor.getAsset(\n    assetId,\n    address(collateral),\n    address(asset),\n    leverageAmount,\n    calldata_.from,\n    calldata_.data\n);\n```
MEDIUM severity: The vulnerability is related to the interface declaration mismatch between the Geist and Aave lendin. The vulnerability is related to the interface declaration mismatch between the Geist and Aave lending protocols. Although Geist is a fork of Aave, their interfaces may diverge in the future, potentially causing issues. The interface declaration `IAaveLendingPool` does not originate from the original...

Vulnerable code:
```\nfunction _getAaveProvider() internal pure returns (IAaveLendingPoolProvider) {\n    return IAaveLendingPoolProvider(0xB53C1a33016B2DC2fF3653530bfF1848a515c8c5);\n}\n```\n```\nSPDX-License-Identifier: MIT\n\npragma solidity ^0.8.0;\n\ninterface IAaveLendingPool {\n    function flashLoan(\n        address receiverAddress,\n        address[] calldata assets,\n        uint256[] calldata amounts,\n        uint256[] calldata modes,\n        address onBehalfOf,\n        bytes calldata params,\n        uint16 referralCode\n    ) external;\n\n    function deposit(\n        address _asset,\n        uint256 _amount,\n        address _onBehalfOf,\n        uint16 _referralCode\n    ) external;\n\n    function withdraw(\n        address _asset,\n        uint256 _amount,\n        address _to\n    ) external;\n\n    function borrow(\n        address _asset,\n        uint256 _amount,\n        uint256 _interestRateMode,\n        uint16 _referralCode,\n        address _onBehalfOf\n    ) external;\n\n    function repay(\n        address _asset,\n        uint256 _amount,\n        uint256 _rateMode,\n        address _onBehalfOf\n    ) external;\n\n    function setUserUseReserveAsCollateral(address _asset, bool _useAsCollateral) external;\n}\n```\n```\nif (amount == type(uint256).max):\n    amountToWithdraw = userBalance\n```\n```\nfunction withdraw(address _asset, uint256 _amount) external payable override {\n    IAaveLendingPool aave = IAaveLendingPool(_getAaveProvider().getLendingPool());\n\n    bool isFtm = _asset == _getFtmAddr();\n    address _tokenAddr = isFtm? _getWftmAddr() : _asset;\n\n    aave.withdraw(_tokenAddr, _amount, address(this));\n\n    // convert WFTM to FTM\n    if (isFtm) {\n        address unwrapper = _getUnwrapper();\n        IERC20(_tokenAddr).univTransfer(payable(unwrapper), _amount);\n        IUnwrapper(unwrapper).withdraw(_amount);\n    }\n}\n```
MEDIUM severity: The EthVault smart contract contains an unused state variable, `withdrawEntryCounter`, which is init. The EthVault smart contract contains an unused state variable, `withdrawEntryCounter`, which is initialized as a `uint256` with an initial value of 0. This variable is declared as a private variable within the contract, indicating that it is intended to be used internally within the contract's logic...

Vulnerable code:
```\nuint256 private withdrawEntryCounter = 0;\n```