Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: Vulnerable function: ```\nfunction _placePerpOrder(\n    uint256 amount,\n    bool isShort,\n    bool amountIsInput,\n   . ```\nfunction _placePerpOrder(\n    uint256 amount,\n    bool isShort,\n    bool amountIsInput,\n    uint160 sqrtPriceLimit\n) private returns (uint256, uint256) {\n    uint256 upperBound = 0; // 0 = no limit, limit set by sqrtPriceLimit\n\n    IClearingHouse.OpenPositionParams memory params = IClea

Vulnerable code:
```\nfunction _placePerpOrder(\n    uint256 amount,\n    bool isShort,\n    bool amountIsInput,\n    uint160 sqrtPriceLimit\n) private returns (uint256, uint256) {\n    uint256 upperBound = 0; // 0 = no limit, limit set by sqrtPriceLimit\n\n    IClearingHouse.OpenPositionParams memory params = IClearingHouse\n        .OpenPositionParams({\n            baseToken: market,\n            isBaseToQuote: isShort, // true for short\n            isExactInput: amountIsInput, // we specify exact input amount\n            amount: amount, // collateral amount - fees\n            oppositeAmountBound: upperBound, // output upper bound\n            // solhint-disable-next-line not-rely-on-time\n            deadline: block.timestamp,\n            sqrtPriceLimitX96: sqrtPriceLimit, // max slippage\n            referralCode: 0x0\n        });\n\n    (uint256 baseAmount, uint256 quoteAmount) = clearingHouse.openPosition(\n        params\n    );\n\n    uint256 feeAmount = _calculatePerpOrderFeeAmount(quoteAmount);\n    totalFeesPaid += feeAmount;\n\n    emit PositionOpened(isShort, amount, amountIsInput, sqrtPriceLimit);\n    return (baseAmount, quoteAmount);\n}\n\nfunction _calculatePerpOrderFeeAmount(uint256 amount)\n    internal\n    view\n    returns (uint256)\n{\n    return amount.mulWadUp(getExchangeFeeWad());\n}\n```\n
HIGH severity: Vulnerable function: ```\n            (lpPrice(\n                virtualPrice,\n                base.. ```\n            (lpPrice(\n                virtualPrice,\n                base.getPrice(tokens[1]),\n                ethPrice,\n                base.getPrice(tokens[0])\n            ) * 1e18) / ethPrice;\n```\n

Vulnerable code:
```\n            (lpPrice(\n                virtualPrice,\n                base.getPrice(tokens[1]),\n                ethPrice,\n                base.getPrice(tokens[0])\n            ) * 1e18) / ethPrice;\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction _convertToToken(address token, address receiver) internal returns (uint256 amountOut) . ```\nfunction _convertToToken(address token, address receiver) internal returns (uint256 amountOut) {\n    // this value should be whatever glp is received by calling withdraw/redeem to junior vault\n    uint256 outputGlp = fsGlp.balanceOf(address(this));\n\n    // using min price of glp because giv

Vulnerable code:
```\nfunction _convertToToken(address token, address receiver) internal returns (uint256 amountOut) {\n    // this value should be whatever glp is received by calling withdraw/redeem to junior vault\n    uint256 outputGlp = fsGlp.balanceOf(address(this));\n\n    // using min price of glp because giving in glp\n    uint256 glpPrice = _getGlpPrice(false);\n\n    // using max price of token because taking token out of gmx\n    uint256 tokenPrice = gmxVault.getMaxPrice(token);\n\n    // apply slippage threshold on top of estimated output amount\n    uint256 minTokenOut = outputGlp.mulDiv(glpPrice * (MAX_BPS - slippageThreshold), tokenPrice * MAX_BPS);\n\n    // will revert if atleast minTokenOut is not received\n    amountOut = rewardRouter.unstakeAndRedeemGlp(address(token), outputGlp, minTokenOut, receiver);\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction freezeSchains(uint nodeIndex) external allow("SkaleManager") {\n    SchainsInternal sc. ```\nfunction freezeSchains(uint nodeIndex) external allow("SkaleManager") {\n    SchainsInternal schainsInternal = SchainsInternal(contractManager.getContract("SchainsInternal"));\n    bytes32[] memory schains = schainsInternal.getActiveSchains(nodeIndex);\n    for (uint i = 0; i < schains.length; 

Vulnerable code:
```\nfunction freezeSchains(uint nodeIndex) external allow("SkaleManager") {\n    SchainsInternal schainsInternal = SchainsInternal(contractManager.getContract("SchainsInternal"));\n    bytes32[] memory schains = schainsInternal.getActiveSchains(nodeIndex);\n    for (uint i = 0; i < schains.length; i++) {\n        Rotation memory rotation = rotations[schains[i]];\n        if (rotation.nodeIndex == nodeIndex && now < rotation.freezeUntil) {\n            continue;\n        }\n        string memory schainName = schainsInternal.getSchainName(schains[i]);\n        string memory revertMessage = "Node cannot rotate on Schain ";\n        revertMessage = revertMessage.strConcat(schainName);\n        revertMessage = revertMessage.strConcat(", occupied by Node ");\n        revertMessage = revertMessage.strConcat(rotation.nodeIndex.uint2str());\n        string memory dkgRevert = "DKG process did not finish on schain ";\n        ISkaleDKG skaleDKG = ISkaleDKG(contractManager.getContract("SkaleDKG"));\n        require(\n            skaleDKG.isLastDKGSuccessful(keccak256(abi.encodePacked(schainName))),\n            dkgRevert.strConcat(schainName));\n        require(rotation.freezeUntil < now, revertMessage);\n        \_startRotation(schains[i], nodeIndex);\n    }\n}\n```\n
MEDIUM severity: Vulnerable function: ```\nif (upcomingMilestone != 0) revert MILESTONES_ALREADY_SET();\n```\n. ```\nif (upcomingMilestone != 0) revert MILESTONES_ALREADY_SET();\n```\n

Vulnerable code:
```\nif (upcomingMilestone != 0) revert MILESTONES_ALREADY_SET();\n```\n
MEDIUM severity: Vulnerable function: ```\n    function _isExternalLendingUnhealthy(\n        uint16 currencyId,\n        IPrimeCashHoldin. ```\n    function _isExternalLendingUnhealthy(\n        uint16 currencyId,\n        IPrimeCashHoldingsOracle oracle,\n        PrimeRate memory pr\n    ) internal view returns (bool isExternalLendingUnhealthy, OracleData memory oracleData, uint256 targetAmount) {\n// rest of code\n\n      PrimeCashFa

Vulnerable code:
```\n    function _isExternalLendingUnhealthy(\n        uint16 currencyId,\n        IPrimeCashHoldingsOracle oracle,\n        PrimeRate memory pr\n    ) internal view returns (bool isExternalLendingUnhealthy, OracleData memory oracleData, uint256 targetAmount) {\n// rest of code\n\n      PrimeCashFactors memory factors = PrimeCashExchangeRate.getPrimeCashFactors(currencyId);\n        Token memory underlyingToken = TokenHandler.getUnderlyingToken(currencyId);\n\n        targetAmount = ExternalLending.getTargetExternalLendingAmount(\n            underlyingToken, factors, rebalancingTargetData, oracleData, pr\n        );\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction harvest(bool \_skipRedeem, bool \_skipIncentivesUpdate, bool[] calldata \_skipReward, . ```\nfunction harvest(bool \_skipRedeem, bool \_skipIncentivesUpdate, bool[] calldata \_skipReward, uint256[] calldata \_minAmount) external {\n  require(msg.sender == rebalancer || msg.sender == owner(), "IDLE:!AUTH");\n```\n

Vulnerable code:
```\nfunction harvest(bool \_skipRedeem, bool \_skipIncentivesUpdate, bool[] calldata \_skipReward, uint256[] calldata \_minAmount) external {\n  require(msg.sender == rebalancer || msg.sender == owner(), "IDLE:!AUTH");\n```\n
HIGH severity: Vulnerable function: ```\nFile: wfCashLogic.sol\n    function _mintInternal(\n..SNIP..\n        if (maxFCash < fCashAmoun. ```\nFile: wfCashLogic.sol\n    function _mintInternal(\n..SNIP..\n        if (maxFCash < fCashAmount) {\n            // NOTE: lending at zero\n            uint256 fCashAmountExternal = fCashAmount * precision / uint256(Constants.INTERNAL_TOKEN_PRECISION); \n            require(fCashAmountExternal <

Vulnerable code:
```\nFile: wfCashLogic.sol\n    function _mintInternal(\n..SNIP..\n        if (maxFCash < fCashAmount) {\n            // NOTE: lending at zero\n            uint256 fCashAmountExternal = fCashAmount * precision / uint256(Constants.INTERNAL_TOKEN_PRECISION); \n            require(fCashAmountExternal <= depositAmountExternal); \n\n            // NOTE: Residual (depositAmountExternal - fCashAmountExternal) will be transferred\n            // back to the account\n            NotionalV2.depositUnderlyingToken{value: msgValue}(address(this), currencyId, fCashAmountExternal);\n..SNIP..\n        // Residual tokens will be sent back to msg.sender, not the receiver. The msg.sender\n        // was used to transfer tokens in and these are any residual tokens left that were not\n        // lent out. Sending these tokens back to the receiver risks them getting locked on a\n        // contract that does not have the capability to transfer them off\n        _sendTokensToReceiver(token, msg.sender, isETH, balanceBefore);\n```\n
HIGH severity: Vulnerable function: ```\nFile: BaseLSTAdapter.sol\n    function prefundedDeposit() external nonReentrant returns (uint25. ```\nFile: BaseLSTAdapter.sol\n    function prefundedDeposit() external nonReentrant returns (uint256, uint256) {\n        uint256 bufferEthCache = bufferEth; // cache storage reads\n        uint256 queueEthCache = withdrawalQueueEth; // cache storage reads\n        uint256 assets = IWETH9(WETH).bal

Vulnerable code:
```\nFile: BaseLSTAdapter.sol\n    function prefundedDeposit() external nonReentrant returns (uint256, uint256) {\n        uint256 bufferEthCache = bufferEth; // cache storage reads\n        uint256 queueEthCache = withdrawalQueueEth; // cache storage reads\n        uint256 assets = IWETH9(WETH).balanceOf(address(this)) - bufferEthCache; // amount of WETH deposited at this time\n        uint256 shares = previewDeposit(assets);\n\n        if (assets == 0) return (0, 0);\n        if (shares == 0) revert ZeroShares();\n```\n
HIGH severity: Vulnerable function: ```\nfunction buyoutLien(ILienToken.LienActionBuyout calldata params) external {\n   // rest of code. ```\nfunction buyoutLien(ILienToken.LienActionBuyout calldata params) external {\n   // rest of code.\n    /**** tranfer but not liensOpenForEpoch-- *****/\n    _transfer(ownerOf(lienId), address(params.receiver), lienId);\n  }\n```\n

Vulnerable code:
```\nfunction buyoutLien(ILienToken.LienActionBuyout calldata params) external {\n   // rest of code.\n    /**** tranfer but not liensOpenForEpoch-- *****/\n    _transfer(ownerOf(lienId), address(params.receiver), lienId);\n  }\n```\n
MEDIUM severity: Vulnerable function: ```\nGEM.\_setSenate(newSenate, block.timestamp + SENATE\_VALIDITY);\n```\n. ```\nGEM.\_setSenate(newSenate, block.timestamp + SENATE\_VALIDITY);\n```\n

Vulnerable code:
```\nGEM.\_setSenate(newSenate, block.timestamp + SENATE\_VALIDITY);\n```\n
MEDIUM severity: Vulnerable function: ```\n    function accrueRate() public {\n        uint256 currentTimestamp = block.timestamp;\n      . ```\n    function accrueRate() public {\n        uint256 currentTimestamp = block.timestamp;\n        if (currentTimestamp == lastUpdateTimestamp) {\n            return;\n        }\n        uint256 timeDifference = block.timestamp - uint256(lastUpdateTimestamp);\n         tRate = tRate.decimalMul((t

Vulnerable code:
```\n    function accrueRate() public {\n        uint256 currentTimestamp = block.timestamp;\n        if (currentTimestamp == lastUpdateTimestamp) {\n            return;\n        }\n        uint256 timeDifference = block.timestamp - uint256(lastUpdateTimestamp);\n         tRate = tRate.decimalMul((timeDifference * borrowFeeRate) / Types.SECONDS_PER_YEAR + 1e18);\n        lastUpdateTimestamp = currentTimestamp;\n    }\n\n    function getTRate() public view returns (uint256) {\n        uint256 timeDifference = block.timestamp - uint256(lastUpdateTimestamp);\n        return tRate + (borrowFeeRate * timeDifference) / Types.SECONDS_PER_YEAR;\n    }\n```\n
HIGH severity: Vulnerable function: ```\n                uint256 assetPreBal = _baseAsset.balanceOf(address(this));\. ```\n                uint256 assetPreBal = _baseAsset.balanceOf(address(this));\n                uint256 assetPulled = destVault.withdrawBaseAsset(sharesToBurn, address(this));\n\n                // Destination Vault rewards will be transferred to us as part of burning out shares\n                //

Vulnerable code:
```\n                uint256 assetPreBal = _baseAsset.balanceOf(address(this));\n                uint256 assetPulled = destVault.withdrawBaseAsset(sharesToBurn, address(this));\n\n                // Destination Vault rewards will be transferred to us as part of burning out shares\n                // Back into what that amount is and make sure it gets into idle\n                info.idleIncrease += _baseAsset.balanceOf(address(this)) - assetPreBal - assetPulled;\n                info.totalAssetsPulled += assetPulled;\n                info.debtDecrease += totalDebtBurn;\n\n                // It's possible we'll get back more assets than we anticipate from a swap\n                // so if we do, throw it in idle and stop processing. You don't get more than we've calculated\n                if (info.totalAssetsPulled > info.totalAssetsToPull) {\n                    info.idleIncrease = info.totalAssetsPulled - info.totalAssetsToPull;\n                    info.totalAssetsPulled = info.totalAssetsToPull;\n                    break;\n                }\n```\n
HIGH severity: Vulnerable function: ```\nfunction didAllocate(\n    uint8 subjectType,\n    uint256 subject,\n    uint256 stakeAmount,\n. ```\nfunction didAllocate(\n    uint8 subjectType,\n    uint256 subject,\n    uint256 stakeAmount,\n    uint256 sharesAmount,\n    address staker\n) external onlyRole(ALLOCATOR\_CONTRACT\_ROLE) {\n    bool delegated = getSubjectTypeAgency(subjectType) == SubjectStakeAgency.DELEGATED;\n    if (delega

Vulnerable code:
```\nfunction didAllocate(\n    uint8 subjectType,\n    uint256 subject,\n    uint256 stakeAmount,\n    uint256 sharesAmount,\n    address staker\n) external onlyRole(ALLOCATOR\_CONTRACT\_ROLE) {\n    bool delegated = getSubjectTypeAgency(subjectType) == SubjectStakeAgency.DELEGATED;\n    if (delegated) {\n        uint8 delegatorType = getDelegatorSubjectType(subjectType);\n        uint256 shareId = FortaStakingUtils.subjectToActive(delegatorType, subject);\n        DelegatedAccRewards storage s = \_rewardsAccumulators[shareId];\n        s.delegated.addRate(stakeAmount);\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction _applyFees(uint256 fee0_, uint256 fee1_) internal {\n    uint16 mManagerFeeBPS = manag. ```\nfunction _applyFees(uint256 fee0_, uint256 fee1_) internal {\n    uint16 mManagerFeeBPS = managerFeeBPS;\n    managerBalance0 += (fee0_ * mManagerFeeBPS) / hundredPercent;\n    managerBalance1 += (fee1_ * mManagerFeeBPS) / hundredPercent;\n}\n```\n

Vulnerable code:
```\nfunction _applyFees(uint256 fee0_, uint256 fee1_) internal {\n    uint16 mManagerFeeBPS = managerFeeBPS;\n    managerBalance0 += (fee0_ * mManagerFeeBPS) / hundredPercent;\n    managerBalance1 += (fee1_ * mManagerFeeBPS) / hundredPercent;\n}\n```\n
HIGH severity: Vulnerable function: ```\nuint holderBalance = SkaleToken(contractManager.getContract("SkaleToken")).. ```\nuint holderBalance = SkaleToken(contractManager.getContract("SkaleToken")).balanceOf(holder);\nuint lockedToDelegate = tokenState.getLockedCount(holder) - tokenState.getPurchasedAmount(holder);\nrequire(holderBalance >= amount + lockedToDelegate, "Delegator hasn't enough tokens to delegate");\n

Vulnerable code:
```\nuint holderBalance = SkaleToken(contractManager.getContract("SkaleToken")).balanceOf(holder);\nuint lockedToDelegate = tokenState.getLockedCount(holder) - tokenState.getPurchasedAmount(holder);\nrequire(holderBalance >= amount + lockedToDelegate, "Delegator hasn't enough tokens to delegate");\n```\n
HIGH severity: Vulnerable function: ```\n  function _buildBoost(\n    address[] calldata partnerNFTs,\n    uint256[] calldata partnerNFT. ```\n  function _buildBoost(\n    address[] calldata partnerNFTs,\n    uint256[] calldata partnerNFTIds\n  ) internal returns (Boost memory newUserBoost) {\n    uint256 magnitude;\n    Boost storage userBoost = boosts[msg.sender];\n    if(userBoost.expiry == 0) {\n// rest of code\n    }\n    else {\

Vulnerable code:
```\n  function _buildBoost(\n    address[] calldata partnerNFTs,\n    uint256[] calldata partnerNFTIds\n  ) internal returns (Boost memory newUserBoost) {\n    uint256 magnitude;\n    Boost storage userBoost = boosts[msg.sender];\n    if(userBoost.expiry == 0) {\n// rest of code\n    }\n    else {\n      address[] storage nfts = userBoost.partnerNFTs;\n      uint256[] storage ids = userBoost.partnerNFTIds;\n      magnitude = userBoost.boostMagnitude; //@audit use old magnitude without checking\n      for (uint256 i = 0; i < partnerNFTs.length; i++) {\n        magnitude += partnerNFTBoosts[partnerNFTs[i]];\n        nfts.push(partnerNFTs[i]);\n        ids.push(partnerNFTIds[i]);\n      }\n      newUserBoost = Boost({\n        partnerNFTs: nfts,\n        partnerNFTIds: ids,\n        expiry: block.timestamp + boostLockDuration,\n        boostMagnitude: magnitude\n      });\n    }\n  }\n```\n
MEDIUM severity: Vulnerable function: ```\n        function _mintInternal(address _receiver,uint _balanceIncreased, uint _totalAsset\n    . ```\n        function _mintInternal(address _receiver,uint _balanceIncreased, uint _totalAsset\n          ) internal returns (uint mintShares) {\n             unfreezeTime[_receiver] = block.timestamp + mintFreezeInterval;\n          if (freezeBuckets.interval > 0) {\n         FreezeBuckets.addToFre

Vulnerable code:
```\n        function _mintInternal(address _receiver,uint _balanceIncreased, uint _totalAsset\n          ) internal returns (uint mintShares) {\n             unfreezeTime[_receiver] = block.timestamp + mintFreezeInterval;\n          if (freezeBuckets.interval > 0) {\n         FreezeBuckets.addToFreezeBuckets(freezeBuckets, _balanceIncreased.toUint96());\n        }\n```\n
MEDIUM severity: Vulnerable function: ```\n        bytes32 orderId = getOrderIdFromOrderRequest(orderRequest, salt);\n. ```\n        bytes32 orderId = getOrderIdFromOrderRequest(orderRequest, salt);\n        uint256 escrow = getOrderEscrow[orderId];\n        if (amount > escrow) revert AmountTooLarge();\n\n\n        // Update escrow tracking\n        getOrderEscrow[orderId] = escrow - amount;\n        // Notify escro

Vulnerable code:
```\n        bytes32 orderId = getOrderIdFromOrderRequest(orderRequest, salt);\n        uint256 escrow = getOrderEscrow[orderId];\n        if (amount > escrow) revert AmountTooLarge();\n\n\n        // Update escrow tracking\n        getOrderEscrow[orderId] = escrow - amount;\n        // Notify escrow taken\n        emit EscrowTaken(orderId, orderRequest.recipient, amount);\n\n\n        // Take escrowed payment\n        IERC20(orderRequest.paymentToken).safeTransfer(msg.sender, amount);\n```\n
MEDIUM severity: Vulnerable function: ```\nfunction requestWithdrawal(uint256 \_tokensToWithdraw) external override {\n```\n. ```\nfunction requestWithdrawal(uint256 \_tokensToWithdraw) external override {\n```\n

Vulnerable code:
```\nfunction requestWithdrawal(uint256 \_tokensToWithdraw) external override {\n```\n
MEDIUM severity: Vulnerable function: ```\nFile: BondAggregator.sol\n    function registerAuctioneer(IBondAuctioneer auctioneer_) external. ```\nFile: BondAggregator.sol\n    function registerAuctioneer(IBondAuctioneer auctioneer_) external requiresAuth {\n        // Restricted to authorized addresses\n\n        // Check that the auctioneer is not already registered\n        if (_whitelist[address(auctioneer_)])\n            revert Aggr

Vulnerable code:
```\nFile: BondAggregator.sol\n    function registerAuctioneer(IBondAuctioneer auctioneer_) external requiresAuth {\n        // Restricted to authorized addresses\n\n        // Check that the auctioneer is not already registered\n        if (_whitelist[address(auctioneer_)])\n            revert Aggregator_AlreadyRegistered(address(auctioneer_));\n\n        // Add the auctioneer to the whitelist\n        auctioneers.push(auctioneer_);\n        _whitelist[address(auctioneer_)] = true;\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\n    function deposit(address r, uint256 a) external override returns (uint256) {\n        if (b. ```\n    function deposit(address r, uint256 a) external override returns (uint256) {\n        if (block.timestamp > maturity) {\n            revert Exception(\n                21,\n                block.timestamp,\n                maturity,\n                address(0),\n                address(0)\n

Vulnerable code:
```\n    function deposit(address r, uint256 a) external override returns (uint256) {\n        if (block.timestamp > maturity) {\n            revert Exception(\n                21,\n                block.timestamp,\n                maturity,\n                address(0),\n                address(0)\n            );\n        }\n        uint128 shares = Cast.u128(previewDeposit(a));\n        Safe.transferFrom(IERC20(underlying), msg.sender, address(this), a);\n        // consider the hardcoded slippage limit, 4626 compliance requires no minimum param.\n        uint128 returned = IMarketPlace(marketplace).sellUnderlying(\n            underlying,\n            maturity,\n            Cast.u128(a),\n            shares - (shares / 100)\n        );\n        _transfer(address(this), r, returned);\n        return returned;\n    }\n```\n
MEDIUM severity: Vulnerable function: ```\n/**\n    * @notice Deposit underlying assets on Compound and issue share token\n    * @param am. ```\n/**\n    * @notice Deposit underlying assets on Compound and issue share token\n    * @param amount Underlying token amount to deposit\n    * @return shareAmount cToken amount\n    */\nfunction deposit(address token, uint256 amount) { // rest of code }\n\n/**\n    * @notice Withdraw underlying 

Vulnerable code:
```\n/**\n    * @notice Deposit underlying assets on Compound and issue share token\n    * @param amount Underlying token amount to deposit\n    * @return shareAmount cToken amount\n    */\nfunction deposit(address token, uint256 amount) { // rest of code }\n\n/**\n    * @notice Withdraw underlying assets from Compound\n    * @param shareAmount Amount of cTokens to redeem\n    * @return withdrawAmount Amount of underlying assets withdrawn\n    */\nfunction withdraw(address token, uint256 shareAmount) { // rest of code }\n```\n
HIGH severity: Vulnerable function: ```\naccounts[account].owners[owner].removedAtBlockNumber = block.number;\n\nemi. ```\naccounts[account].owners[owner].removedAtBlockNumber = block.number;\n\nemit AccountOwnerRemoved(\n account,\n owner\n);\n```\n

Vulnerable code:
```\naccounts[account].owners[owner].removedAtBlockNumber = block.number;\n\nemit AccountOwnerRemoved(\n account,\n owner\n);\n```\n
HIGH severity: Vulnerable function: ```\n1) Deposit ERC721\n2) Set creditor to malicious designed creditor\n3) Trans. ```\n1) Deposit ERC721\n2) Set creditor to malicious designed creditor\n3) Transfer the account to itself\n4) flashActionByCreditor to transfer ERC721\n    4a) account owns itself so _transferFromOwner allows transfers from account\n    4b) Account is now empty but still thinks is has ERC721\n5) Use

Vulnerable code:
```\n1) Deposit ERC721\n2) Set creditor to malicious designed creditor\n3) Transfer the account to itself\n4) flashActionByCreditor to transfer ERC721\n    4a) account owns itself so _transferFromOwner allows transfers from account\n    4b) Account is now empty but still thinks is has ERC721\n5) Use malicious designed liquidator contract to call auctionBoughtIn\n    and transfer account back to attacker\n7) Update creditor to legitimate creditor\n8) Take out loan against nothing\n9) Profit\n```\n