Aave DIVA Wrapper

Issue:
The AaveDIVAWrapper contract employs type(uint256).max to set unlimited approvals for ERC-20 tokens when interacting with external protocols (DIVA and Aave). However, this approach overlooks non-standard token implementations or tokens that impose constraints on maximum approval amounts.

Affected Code Snippets:

• Registering Collateral Tokens:

• Approving Collateral Tokens for Aave:

2. Root Cause

The contract assumes all ERC-20 tokens strictly adhere to the standard approve behavior, allowing allowances to be set to type(uint256).max. However, certain tokens behave differently:

• COMP: Casts type(uint256).max to a smaller type (e.g., type(uint96).max).

The absence of checks or alternative strategies for handling non-standard token behavior results in potential transaction failures during approval.

3. Impact Analysis

• Functionality Disruption:
  Users registering or interacting with collateral tokens that do not support type(uint256).max approvals (e.g., COMP) will encounter transaction reverts. This restricts usability to tokens fully compatible with the standard approval mechanism.

• User Experience:
  Limited support for widely adopted tokens reduces the contract’s appeal, potentially deterring users who want to use these tokens as collateral.

• Security Risks:
  Though primarily a functional issue, unexpected reverts could be exploited in complex scenarios to disrupt contract operations or manipulate state transitions, particularly when combined with other vulnerabilities.

4. Recommendations

To enhance compatibility and ensure robust approval handling across diverse ERC-20 tokens, consider the following measures:

• Custom Approval Amounts:
  Instead of universally setting allowances to type(uint256).max, allow setting specific approval amounts based on token compatibility or user preference.

2. Token Compatibility Checks

• Interface Detection:
  Implement checks to detect if a token supports specific approval behaviors or interfaces, adapting strategies accordingly.

• Whitelist Supported Tokens:
  Maintain a whitelist of tokens known to support type(uint256).max approvals and handle others with alternative methods.