Submission Details
Severity:
User's shortToken and longToken balance should be checked before transferring the tokens to the wrapper contract in `AaveDIVAWrapperCore::_removeLiquidity`.
Summary
The AaveDIVAWrapperCore::_removeLiquidity transfers the short and long token to the wrapper contract without checking the user's token balance.
Vulnerability Details
Impact
unwanted revert with no proper message. https://github.com/Cyfrin/2025-01-diva/blob/main/DOCUMENTATION.md#reverts-2
Tools Used
Manual Review
Recommendations
function _removeLiquidity(
bytes32 _poolId,
uint256 _positionTokenAmount,
address _recipient
) internal returns (uint256) {
...
uint256 _userBalanceShort = _shortTokenContract.balanceOf(msg.sender);
uint256 _userBalanceLong = _longTokenContract.balanceOf(msg.sender);
uint256 _positionTokenAmountToRemove = _positionTokenAmount;
+ if(_positionTokenAmount > _userBalanceLong || _positionTokenAmount > _userBalanceShort){
+ revert NOT_ENOUGH_TOKEN_BALANCE();
+ }
if (_positionTokenAmount == type(uint256).max) {
_positionTokenAmountToRemove = _userBalanceShort > _userBalanceLong ? _userBalanceLong : _userBalanceShort;
}
...
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
51929 USDC / LOC
14,000
1,000
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.