Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Token Unregistration Mechanism Creates Permanent Security Risk for Compromised Tokens

pro_king

Summary

The AaveDIVAWrapper protocol lacks functionality to unregister or remove compromised tokens from its registered token list. This creates a permanent security risk as compromised tokens remain active in the system indefinitely.

Vulnerability Details

Missing Functionality

// Current registration functionality
mapping(address => address) private _collateralTokenToWToken;
mapping(address => address) private _wTokenToCollateralToken;
​
function registerToken(...) {
// Can add tokens
_collateralTokenToWToken[token] = wToken;
_wTokenToCollateralToken[wToken] = token;
}
​
// Missing but needed:
function unregisterToken(address token) {
// No way to remove compromised tokens
}

Technical Impact

Permanent Token Registration

  • Once registered, tokens cannot be removed

  • Compromised tokens remain active

  • No emergency stop for specific tokens

Impact

  1. Compromised Tokens

    • Cannot block usage of hacked tokens

    • Continued exposure to vulnerable assets

    • Forced protocol-wide pause might be needed

  2. User Funds

    • Continued acceptance of compromised tokens

    • No way to prevent new deposits

    • Existing positions(deposits) remain at risk

  3. Protocol Security

    • No granular control over token usage

Tools Used

  • Manual review

Recommendations

Add Unregistration Function so if the token is compromised, it can be removed from the system.

Updates

Lead Judging Commences

bube Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] No way to remove collateral tokens

This is invalid. If the collateral token is not supported by Aave or invalid, the `registerCollateralToken` will revert. If the collateral token is deprecated by Aave due to a given issue, this is known issue: "Integration risk with both Aave V3 and DIVA Protocol - vulnerabilities in either protocol may affect AaveDIVAWrapper."

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.