Aave DIVA Wrapper

Root Cause

The AaveDIVAWrapper contract does not enforce a minimum transaction amount in critical functions such as createContingentPool, addLiquidity, and redeemWToken. This allows attackers to submit transactions with dust amounts (e.g., 1 wei of an ERC20 token with 18 decimals), even if the value is economically negligible.

Technical Breakdown:

• ERC20 tokens often have high decimal precision (e.g., 6 decimals for USDC, 18 for ETH-based tokens).

• Functions like _handleTokenOperations accept _collateralAmount without validating against a minimum threshold (e.g., > 0 or >= MIN_AMOUNT).

• Example:

  function _handleTokenOperations(...) private {

  // No check for _collateralAmount > 0

  IERC20Metadata(_collateralToken).safeTransferFrom(msg.sender, address(this), _collateralAmount);

  IAave(_aaveV3Pool).supply(_collateralToken, _collateralAmount, ...);

  }

Impact

1. Network Spam: Attackers can flood the blockchain with dust transactions (e.g., 1e-10 of a token), increasing gas fees and degrading network performance.

2. Storage Bloat: Dust transactions create unnecessary entries in the contract’s state (e.g., pool IDs, token balances), straining storage and indexing.

3. Economic Disruption: Trivial pools or liquidity positions could confuse users or distort protocol metrics.

Real-World Example:

• An attacker submits 10,000 createContingentPool transactions with 1 wei of collateral (effectively $0.00000001), wasting network resources.

Recommendations

1. Enforce Minimum Amounts:

   • Add token-specific minimum checks (e.g., require(_collateralAmount >= MIN_AMOUNT, "Amount too small")).

   • Example:

     uint256 public constant MIN_COLLATERAL = 1e6; // 1 USDC (6 decimals)

     function _handleTokenOperations(...) private {

     require(_collateralAmount >= MIN_COLLATERAL, "Amount too small");

     // Rest of the code

     }

2. Bound Checks for type(uint256).max:

   • Ensure resolved amounts (e.g., user balances) are > 0 when type(uint256).max is used.

3. Decentralized Governance:

   • Allow governance to update MIN_AMOUNT per token to adapt to market conditions.