Farseen0/scar-pairs huggingface dataset:
MEDIUM severity: The `setContractAddress()` function in the provided smart contract code allows for the creation of d. The `setContractAddress()` function in the provided smart contract code allows for the creation of duplicate entries in the `contractKeys` array when a contract is added with an address of `0`. This occurs because the function checks for the existence of a contract by inspecting the `contractAddress...

Vulnerable code:
```\nfunction setContractAddress(bytes32 name, address addr) public returns (bool) {\n    require(name!= 0x0000000000000000000000000000000000000000000000000000000000000000, "Contract name must not be empty.");\n    require(isAuthorized(msg.sender), "Not authorized to update contract registry.");\n\n    ContractDetails memory info = registry[name];\n\n    if (info.contractAddress == address(0)) {\n        info = ContractDetails({\n            owner: msg.sender,\n            contractAddress: addr\n        });\n\n        contractKeys.push(name);\n    } else {\n        info.contractAddress = addr;\n    }\n\n    registry[name] = info;\n\n    emit RegistryUpdated(addr, name);\n\n    return true;\n}\n```
MEDIUM severity: The `notifyFor` method, which is publicly accessible, allows an attacker to manipulate the stake of . The `notifyFor` method, which is publicly accessible, allows an attacker to manipulate the stake of any account in linked governance modules. This method is intended to be used to update the balance of another account, but it takes the caller's balance instead of the target account's balance. This v...

Vulnerable code:
```\nfunction notifyFor(address account) external {\n    _notifyFor(account, balanceOf(msg.sender));\n}\n```\n```\nfunction _notifyFor(address account, uint256 balance) private {\n    uint256 modulesLength = _modules.length();\n    for (uint256 i = 0; i < modulesLength; i++) {\n        IGovernanceModule(_modules.at(i)).notifyStakeChanged(account, balance);\n    }\n}\n```\n```\nfunction notifyStakeChanged(address account, uint256 newBalance) external override onlyMothership {\n    _notifyStakeChanged(account, newBalance);\n}\n```\n```\nfunction _notifyStakeChanged(address account, uint256 newBalance) internal override {\n    uint256 balance = balanceOf(account);\n    if (newBalance > balance) {\n        _mint(account, newBalance.sub(balance));\n    } else if (newBalance < balance) {\n        _burn(account, balance.sub(newBalance));\n    } else {\n        return;\n    }\n\n    uint256 newTotalSupply = totalSupply();\n\n    _defaultFee.updateBalance(account, _defaultFee.votes[account], balance, newBalance, newTotalSupply, _DEFAULT_FEE, _emitDefaultFeeVoteUpdate);\n    _defaultSlippageFee.updateBalance(account, _defaultSlippageFee.votes[account], balance, newBalance, newTotalSupply, _DEFAULT_SLIPPAGE_FEE, _emitDefaultSlippageFeeVoteUpdate);\n    _defaultDecayPeriod.updateBalance(account, _defaultDecayPeriod.votes[account], balance, newBalance, newTotalSupply, _DEFAULT_DECAY_PERIOD, _emitDefaultDecayPeriodVoteUpdate);\n    _referralShare.updateBalance(account, _referralShare.votes[account], balance, newBalance, newTotalSupply, _DEFAULT_REFERRAL_SHARE, _emitReferralShareVoteUpdate);\n    _governanceShare.updateBalance(account, _governanceShare.votes[account], balance, newBalance, newTotalSupply, _DEFAULT_GOVERNANCE_SHARE, _emitGovernanceShareVoteUpdate);\n}\n```\n```\nfunction _notifyStakeChanged(address account, uint256 newBalance) internal override updateReward(account) {\n    uint256 balance = balanceOf(account);\n    if (newBalance > balance) {\n        _mint(account, newBalance.sub(balance));\n    } else if (newBalance < balance) {\n        _burn(account, balance.sub(newBalance));\n    }\n}\n```
MEDIUM severity: The Funding#requestWithdraw function in the provided smart contract contains a critical vulnerabilit. The Funding#requestWithdraw function in the provided smart contract contains a critical vulnerability that can lead to the loss of funds. The issue arises from the incorrect usage of the `msg.sender` variable, which is used to store the pending withdraw amounts instead of the intended `from` address...

Vulnerable code:
```\nfunction requestWithdraw(\n    Types.State storage state,\n    address from,\n    uint256 primaryAmount,\n    uint256 secondaryAmount\n)\n    external\n{\n    require(isWithdrawValid(state, msg.sender, from, primaryAmount, secondaryAmount), Errors.WITHDRAW_INVALID);\n    state.pendingPrimaryWithdraw[msg.sender] = primaryAmount;\n    state.pendingSecondaryWithdraw[msg.sender] = secondaryAmount;\n    state.withdrawExecutionTimestamp[msg.sender] = block.timestamp + state.withdrawTimeLock;\n    emit RequestWithdraw(msg.sender, primaryAmount, secondaryAmount, state.withdrawExecutionTimestamp[msg.sender]);\n}\n```
MEDIUM severity: The vulnerability lies in the scalar multiplication functions `point_mul` and `point_acc_mul` in the. The vulnerability lies in the scalar multiplication functions `point_mul` and `point_acc_mul` in the Plonk protocol, which fail to perform a crucial range check on the scalar field proof elements. Specifically, the functions do not verify that the scalar `s` is within the valid range of the scalar f...

Vulnerable code:
```\nfunction point_mul(dst, src, s, mPtr) {\n    let mPtr := add(mload(0x40), state_last_mem)\n    let state := mload(0x40)\n    mstore(mPtr, mload(src))\n    mstore(add(mPtr, 0x20), mload(add(src, 0x20)))\n    mstore(add(mPtr, 0x40), s)\n    let l_success := staticcall(sub(gas(), 2000), 7, mPtr, 0x60, dst, 0x40)\n    mstore(add(state, state_success), and(l_success, mload(add(state, state_success))))\n\nfunction point_acc_mul(dst, src, s, mPtr) {\n    let state := mload(0x40)\n    mstore(mPtr, mload(src))\n    mstore(add(mPtr, 0x20), mload(add(src, 0x20)))\n    mstore(add(mPtr, 0x40), s)\n    let l_success := staticcall(sub(gas(), 2000), 7, mPtr, 0x60, mPtr, 0x40)\n    mstore(add(mPtr, 0x40), mload(dst))\n    mstore(add(mPtr, 0x60), mload(add(dst, 0x20)))\n    l_success := and(l_success, staticcall(sub(gas(), 2000), 6, mPtr, 0x80, dst, 0x40))\n    mstore(add(state, state_success), and(l_success, mload(add(state, state_success))))\n```
MEDIUM severity: The `RocketNetworkVoting.calculateVotingPower()` function contains two vulnerabilities related to pa. The `RocketNetworkVoting.calculateVotingPower()` function contains two vulnerabilities related to parameter handling. Firstly, the `matchedETH` parameter is not utilized within the function, indicating that it is not being used to calculate the voting power. This unused parameter may be a potential...

Vulnerable code:
```\nRocketDAOProtocolSettingsNodeInterface rocketDAOProtocolSettingsNode = \n    RocketDAOProtocolSettingsNodeInterface(getContractAddress("rocketDAOProtocolSettingsNode"));\n```\n```\nkey = keccak256(abi.encodePacked("rpl.staked.node.amount", _nodeAddress));\nuint256 rplStake = uint256(rocketNetworkSnapshots.lookupRecent(key, uint32(_block), 5));\n\nreturn calculateVotingPower(rplStake, ethMatched, ethProvided, rplPrice);\n```\n```\nuint256 maximumStake = providedETH * maximumStakePercent / rplPrice;\n```
MEDIUM severity: The `FeeBuyback.submit()` method in the `FeeBuyback.sol` contract may fail if the `_referral` contra. The `FeeBuyback.submit()` method in the `FeeBuyback.sol` contract may fail if the `_referral` contract does not utilize the entire allowance granted by the `safeApprove()` method. This occurs when the `_telcoin` token is involved, as the `safeApprove()` method, which is part of the `SafeERC20Upgrade...

Vulnerable code:
```\nrequire(\n    value == 0 || token.allowance(address(this), spender) == 0,\n    "SafeERC20: approve from non-zero to non-zero allowance"\n);\n```
MEDIUM severity: The `RocketDAOProtocolSettingsRewards.setSettingRewardClaimPeriods()` function is vulnerable to an u. The `RocketDAOProtocolSettingsRewards.setSettingRewardClaimPeriods()` function is vulnerable to an unauthorized modification of the `rewards.claims.periods` setting. This setting is responsible for controlling the claim periods for rewards in the RocketDAO protocol.\n\nThe issue arises from the fact...

Vulnerable code:
```\nsetUint(\n    keccak256(\n        abi.encodePacked(\n            settingNameSpace,\n            "rewards.claims",\n            "periods"\n        )\n    ),\n    _periods\n);\n```
MEDIUM severity: When a trading fee is modified, the refund amount for a previously created quote may be incorrect. T. When a trading fee is modified, the refund amount for a previously created quote may be incorrect. This is because the fee calculation is based on the original trading fee value, which is stored in the `symbol.tradingFee` variable. This variable is used in the `getTradingFee` function to determine t...

Vulnerable code:
```\nfunction getTradingFee(uint256 quoteId) internal view returns (uint256 fee) {\n    QuoteStorage.Layout storage quoteLayout = QuoteStorage.layout();\n    Quote storage quote = quoteLayout.quotes[quoteId];\n    Symbol storage symbol = SymbolStorage.layout().symbols[quote.symbolId];\n\n    if (quote.orderType == OrderType.LIMIT) {\n        fee = (LibQuote.quoteOpenAmount(quote) * quote.requestedOpenPrice * symbol.tradingFee) / 1e36;\n    } else {\n        fee = (LibQuote.quoteOpenAmount(quote) * quote.marketPrice * symbol.tradingFee) / 1e36;\n    }\n}\n```
MEDIUM severity: The `hedgeDelta()` function in the contract calculates the `priceToUse` variable incorrectly when th. The `hedgeDelta()` function in the contract calculates the `priceToUse` variable incorrectly when the `_delta` parameter is negative or positive. Specifically, when `_delta` is negative, `priceToUse` is set to the minimum of `quotePrice` and `underlyingPrice`. This calculation is problematic because...

Vulnerable code:
```\nuint256 priceToUse = quotePrice < underlyingPrice? quotePrice : underlyingPrice;\n\nRangeOrderDirection direction = inversed? RangeOrderDirection.ABOVE \n    : RangeOrderDirection.BELOW;\n\nRangeOrderParams memory rangeOrder = _getTicksAndMeanPriceFromWei(priceToUse, direction);\n```\n```\nint24 lowerTick = direction == RangeOrderDirection.ABOVE? \n    nearestTick + tickSpacing : nearestTick - (2 * tickSpacing);\n\nint24 tickUpper = direction == RangeOrderDirection.ABOVE? \n    lowerTick + tickSpacing : nearestTick - tickSpacing;\n```
MEDIUM severity: The presence of commented code in the BMath library is a potential security concern. The commented c. The presence of commented code in the BMath library is a potential security concern. The commented code blocks, which are not executed, still pose a risk as they can be easily uncommented or modified to introduce malicious logic into the code.\n\nThe commented code snippets appear to be performing c...

Vulnerable code:
```\nuint tokenInRatio = bdiv(newTokenBalanceIn, tokenBalanceIn);\n\nuint poolRatio = bpow(tokenInRatio, normalizedWeight);\n```\n```\nuint normalizedWeight = bdiv(tokenWeightOut, totalWeight);\n\nuint poolAmountInAfterExitFee = bmul(poolAmountIn, bsub(BONE, EXIT_FEE));\n```
MEDIUM severity: The `calculateMultiSwap` function in the `SwapExchange` contract is responsible for calculating the . The `calculateMultiSwap` function in the `SwapExchange` contract is responsible for calculating the amount of tokenA that can be received for a given amount of tokenB in a multi-swap scenario. This function is intended to be used by the frontend to preview the result of a `MultiSwap` operation. Howe...

Vulnerable code:
```\nfunction calculateMultiSwap(SwapUtils.MultiClaimInput calldata multiClaimInput) external view returns (SwapUtils.SwapCalculation memory) {\n    uint256 swapIdCount = multiClaimInput.swapIds.length;\n    if (swapIdCount == 0 || swapIdCount > _maxHops) {\n        revert Errors.InvalidMultiClaimSwapCount(_maxHops, swapIdCount);\n    }\n    if (swapIdCount == 1) {\n        SwapUtils.Swap memory swap = swaps[multiClaimInput.swapIds[0]];\n        return SwapUtils._calculateSwapNetB(swap, multiClaimInput.amountB, _feeValue, _feeDenominator, _fixedFee);\n    }\n    uint256 matchAmount = multiClaimInput.amountB;\n    address matchToken = multiClaimInput.tokenB;\n    uint256 swapId;\n    bool complete = true;\n    for (uint256 i = 0; i < swapIdCount; i++) {\n        swapId = multiClaimInput.swapIds[i];\n        SwapUtils.Swap memory swap = swaps[swapId];\n        if (swap.tokenB!= matchToken) {\n            revert Errors.NonMatchingToken();\n        }\n        if (swap.amountB < matchAmount) {\n            if (!swap.isPartial) {\n                revert Errors.NotPartialSwap();\n            }\n            matchAmount = MathUtils._mulDiv(swap.amountA, matchAmount, swap.amountB);\n            complete = complete && false;\n        } else {\n            matchAmount = swap.amountA;\n        }\n        matchToken = swap.tokenA;\n    }\n    (uint8 feeType,) = _calculateFeeType(multiClaimInput.tokenA, multiClaimInput.tokenB);\n    uint256 fee = FeeUtils._calculateFees(matchAmount, multiClaimInput.amountB, feeType, swapIdCount, _feeValue, _feeDenominator, _fixedFee);\n    SwapUtils.SwapCalculation memory calculation;\n    calculation.amountA = matchAmount;\n    calculation.amountB = multiClaimInput.amountB;\n    calculation.fee = fee;\n    calculation.feeType = feeType;\n    calculation.isTokenBNative = multiClaimInput.tokenB == Constants.NATIVE_ADDRESS;\n    calculation.isComplete = complete;\n    calculation.nativeSendAmount = SwapUtils._calculateNativeSendAmount(calculation.amountB, calculation.fee, calculation.feeType, calculation.isTokenBNative);\n    return calculation;\n}\n```
MEDIUM severity: The vulnerability lies in the accounting mechanism for burned gETH within the Geode Portal's burn fu. The vulnerability lies in the accounting mechanism for burned gETH within the Geode Portal's burn function. Specifically, when users redeem gETH for ETH, the `burn` function correctly subtracts the spent gETH minus the `gEthDonation` from the total supply. However, the subsequent accounting code fai...

Vulnerable code:
```\nDATASTORE.subUintForId(poolId, "surplus", spentSurplus);\nself.gETH.burn(address(this), poolId, spentGeth - gEthDonation);\n\nif (self.TELESCOPE._isOracleActive()) {\n    bytes32 dailyBufferKey = DataStoreUtils.getKey(\n        block.timestamp - (block.timestamp % OracleUtils.ORACLE_PERIOD),\n        "burnBuffer"\n    );\n    DATASTORE.addUintForId(poolId, dailyBufferKey, spentGeth);\n}\n```
MEDIUM severity: The CrossDomainMessenger contract's gas consumption calculation for cross-chain messages is flawed, . The CrossDomainMessenger contract's gas consumption calculation for cross-chain messages is flawed, leading to a discrepancy between the actual gas usage and the expected gas consumption. This discrepancy arises from the failure to account for the gas usage of the "relayMessage" wrapper, which incre...

Vulnerable code:
```\ndataLen := uint64(len(data))\n\nif dataLen > 0 {\n    // rest of code\n}\n```
MEDIUM severity: The computation of the `amountToSellUnits` variable in the `BuyUSSDSellCollateral()` function is fla. The computation of the `amountToSellUnits` variable in the `BuyUSSDSellCollateral()` function is flawed, which may result in an incorrect amount of collateral being sold during a peg-down recovery event. The issue arises from the formula used to calculate `amountToSellUnits`, which is:\n\n`uint256 a...

Vulnerable code:
```\nuint256 amountToSellUnits = IERC20Upgradeable(collateral[i].token).balanceOf(USSD) * \n    ((amountToBuyLeftUSD * 1e18) / collateralval) / 1e18;\n```\n```\nuint256 amountToSellUnits = (collateralBalance * amountToBuyLeftUSD * 1e18) / (collateralval * 1e18 * 1e18);\n\nuint256 amountToSellUnits = (collateralBalance * amountToBuyLeftUSD) / (collateralval * 1e18);\n```
MEDIUM severity: The Chainlink Oracle Wrapper's `latestRoundData` function retrieves the latest data from the Chainli. The Chainlink Oracle Wrapper's `latestRoundData` function retrieves the latest data from the Chainlink oracle, which is then checked for freshness by verifying that the returned answer corresponds to the last known round. However, the `updatedAt` timestamp is not validated, leaving the system vulner...

Vulnerable code:
```\nfunction read() external view override returns (Decimal.D256 memory, bool) {\n    (uint80 roundId, int256 price,,, uint80 answeredInRound) = chainlinkOracle.latestRoundData();\n    bool valid =!paused() && price > 0 && answeredInRound == roundId;\n\n    Decimal.D256 memory value = Decimal.from(uint256(price)).div(oracleDecimalsNormalizer);\n    return (value, valid);\n}\n```\n```\nfunction isOutdated() external view override returns (bool) {\n    (uint80 roundId,,, uint80 answeredInRound) = chainlinkOracle.latestRoundData();\n    return answeredInRound!= roundId;\n}\n```
MEDIUM severity: The vulnerability lies in the `VaultAccountAction.sol` code, specifically in the `full exit` functio. The vulnerability lies in the `VaultAccountAction.sol` code, specifically in the `full exit` functionality. When a StrategyVault performs a full exit for a vault account, it can potentially leave behind outstanding secondary debt without repaying it. This is because the Notional-side does not verify...

Vulnerable code:
```\nFile: VaultAccountAction.sol\n\nif (vaultAccount.accountDebtUnderlying == 0 && vaultAccount.vaultShares == 0) {\n    if the account has no position in the vault at this point, set the maturity to zero as well\n    vaultAccount.maturity = 0;\n}\n\nvaultAccount.setVaultAccount({vaultConfig: vaultConfig, checkMinBorrow: true});\n\nif (vaultAccount.maturity!= 0) {\n    IVaultAccountHealth(address(this)).checkVaultAccountCollateralRatio(vault, account);\n}\n```
MEDIUM severity: The `isValidRefinance` function in the `AstariaRouter` contract is designed to validate whether a re. The `isValidRefinance` function in the `AstariaRouter` contract is designed to validate whether a refinance is valid based on two conditions: either the loan interest rate decreases by more than 0.5% or the loan duration increases by more than 14 days. However, the current implementation of this fun...

Vulnerable code:
```\nif (!ASTARIA_ROUTER.isValidRefinance(lienData[lienId], ld)) {\n    revert InvalidRefinance();\n}\n```\n```\nreturn (\n    newLien.rate >= minNewRate &&\n    (block.timestamp + newLien.duration - lien.start - lien.duration) >= minDurationIncrease\n);\n```
MEDIUM severity: The `StrategyBase` contract, a fundamental component of ERC-4626-based systems, employs a mechanism . The `StrategyBase` contract, a fundamental component of ERC-4626-based systems, employs a mechanism to prevent inflation attacks by ensuring that the total shares in existence for a particular strategy are either zero or at least a minimum amount, set to 10^9. This safeguard is designed to thwart in...

Vulnerable code:
```\nuint256 updatedTotalShares = totalShares + newShares;\nrequire(updatedTotalShares >= MIN_NONZERO_TOTAL_SHARES, "StrategyBase.deposit: updated totalShares amount would be nonzero but below MIN_NONZERO_TOTAL_SHARES");\n```\n```\nuint256 updatedTotalShares = priorTotalShares - amountShares;\n\nrequire(updatedTotalShares >= MIN_NONZERO_TOTAL_SHARES || updatedTotalShares == 0,\n    "StrategyBase.withdraw: updated totalShares amount would be nonzero but below MIN_NONZERO_TOTAL_SHARES");\n```
MEDIUM severity: The `registerClaimer` function in the RocketRewardsPool contract does not properly validate the `_cl. The `registerClaimer` function in the RocketRewardsPool contract does not properly validate the `_claimerAddress` parameter before decrementing the `rewards.pool.claim.interval.claimers.total.next` variable. Specifically, the function does not check if the provided `_claimerAddress` is already disab...

Vulnerable code:
```\nfunction registerClaimer(address _claimerAddress, bool _enabled) override external onlyClaimContract {\n    string memory contractName = getContractName(msg.sender);\n    uint256 registeredBlock = 0;\n    uint256 claimersIntervalTotalUpdate = getClaimingContractUserTotalNext(contractName);\n\n    if (_enabled) {\n        require(getClaimingContractUserRegisteredBlock(contractName, _claimerAddress) == 0, "Claimer is already registered");\n        registeredBlock = block.number;\n        claimersIntervalTotalUpdate = claimersIntervalTotalUpdate.add(1);\n        setUint(keccak256(abi.encodePacked("rewards.pool.claim.interval.claimers.total.next", contractName)), claimersIntervalTotalUpdate);\n    } else {\n        claimersIntervalTotalUpdate = claimersIntervalTotalUpdate.sub(1);\n        setUint(keccak256(abi.encodePacked("rewards.pool.claim.interval.claimers.total.next", contractName)), claimersIntervalTotalUpdate);\n    }\n\n    setUint(keccak256(abi.encodePacked("rewards.pool.claim.contract.registered.block", contractName, _claimerAddress)), registeredBlock);\n}\n```
MEDIUM severity: The `cancelOrder` method, provided by the exchange, is intended to allow traders or brokers to cance. The `cancelOrder` method, provided by the exchange, is intended to allow traders or brokers to cancel pending orders. However, a critical flaw in the implementation renders this functionality ineffective. Specifically, the method only stores the hash of the canceled order in the `cancelled` mapping,...

Vulnerable code:
```\nfunction cancelOrder(LibOrder.Order memory order) public {\n    require(msg.sender == order.trader || msg.sender == order.broker, "invalid caller");\n\n    bytes32 orderHash = order.getOrderHash();\n    cancelled[orderHash] = true;\n\n    emit Cancel(orderHash);\n}\n```
MEDIUM severity: The vulnerability is a critical issue in the `updateGlobalPositionData` function of the FlatcoinVaul. The vulnerability is a critical issue in the `updateGlobalPositionData` function of the FlatcoinVault smart contract. When a long trader's position is liquidated, the function is triggered to update the global position data. However, the current implementation allows the losses of some long traders...

Vulnerable code:
```\npriceShift = current_price - last_price\npriceShift = $600 - $1000 = -$400\n\nprofitLossTotal = (globalPosition.sizeOpenedTotal * priceShift) / current_price\nprofitLossTotal = (12 * -400) / 600\nprofitLossTotal = -8\n```\n```\nnewMarginDepositedTotal = _globalPositions.marginDepositedTotal + _marginDelta + profitLossTotal\nnewMarginDepositedTotal = _globalPositions.marginDepositedTotal + _marginDelta + profitLossTotal\nnewMarginDepositedTotal = _globalPositions.marginDepositedTotal + _marginDelta + (-8 ETH) = 0 ETH\n```\n```\nfunction updateGlobalPositionData(\n    uint256 _price,\n    int256 _marginDelta,\n    int256 _additionalSizeDelta\n) external onlyAuthorizedModule {\n    int256 profitLossTotal = PerpMath._profitLossTotal({\n        globalPosition: _globalPositions,\n        price: _price\n    });\n\n    int256 newMarginDepositedTotal = int256(_globalPositions.marginDepositedTotal) + _marginDelta + profitLossTotal;\n\n    if (newMarginDepositedTotal < 0) {\n        revert FlatcoinErrors.InsufficientGlobalMargin();\n    }\n\n    _globalPositions = FlatcoinStructs.GlobalPositions({\n        marginDepositedTotal: uint256(newMarginDepositedTotal),\n        sizeOpenedTotal: (int256(_globalPositions.sizeOpenedTotal) + _additionalSizeDelta).toUint256(),\n        lastPrice: _price\n    });\n\n    _updateStableCollateralTotal(-profitLossTotal);\n}\n```